Close safe COM boundaries and preserve symlinked assemblies

Make Automation storage and arbitrary COM queries private, add compile-fail API regressions, follow DLL symlinks, and exercise payload-independent launcher smoke checks.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SteveL-MSFT

rust/tests/WindowsLauncher.Tests.ps1

@@ -102,6 +102,11 @@ Describe 'Packaged Rust Windows launcher' {
         Join-Path (Split-Path $ExecutablePath) 'pwrshplugin.dll' | Should -Not -Exist
     }
 
+    It 'passes the documented native smoke script without requiring a managed payload' {
+        & "$PSScriptRoot/../windows/tests/launcher-smoke.ps1" -ExecutablePath $ExecutablePath -Configuration $Configuration |
+            Should -Be 'Launcher resources and native smoke checks passed.'
+    }
+
     if ($Configuration -eq 'coreclr') {
         It 'prints native help for <Argument> without requiring CoreCLR' -ForEach @(
             @{ Argument = '-?' }
@@ -159,6 +164,24 @@ Describe 'Packaged Rust Windows launcher' {
             $result.Output | Should -Not -Match '\x00'
         }
 
+        It 'starts CoreCLR when required managed assemblies are symbolic links' {
+            $linkedHome = Join-Path $TestDrive 'symlinked-coreclr'
+            New-Item -ItemType Directory $linkedHome > $null
+            Copy-Item "$coreClrHome/*" $linkedHome -Recurse
+            $targets = Join-Path $TestDrive 'assembly-targets'
+            New-Item -ItemType Directory $targets > $null
+            foreach ($name in @('System.Private.CoreLib.dll', 'Microsoft.PowerShell.ConsoleHost.dll')) {
+                $link = Join-Path $linkedHome $name
+                $target = Join-Path $targets $name
+                Move-Item -LiteralPath $link -Destination $target
+                New-Item -ItemType SymbolicLink -Path $link -Target $target > $null
+            }
+            $result = Invoke-Launcher -Path (Join-Path $linkedHome 'powershell.exe') -Arguments @(
+                '-NoLogo', '-NoProfile', '-NonInteractive', '-Command', 'exit 37'
+            )
+            $result.ExitCode | Should -Be 37 -Because "$($result.Output) $($result.Error)"
+        }
+
         It 'loads an external payload from BOM-prefixed configuration starting with <FirstSetting>' -ForEach @(
             @{ FirstSetting = 'PSHOMEDIR' }
             @{ FirstSetting = 'CORECLRDIR' }
@@ -183,8 +206,8 @@ Describe 'Packaged Rust Windows launcher' {
     } else {
         It 'rejects malformed Framework options without requiring a managed payload' {
             $result = Invoke-Launcher -Path $ExecutablePath -Arguments @('-Version', 'invalid')
-            $result.ExitCode | Should -Not -Be 0
-            $result.Error | Should -Match 'PowerShell native host error'
+            $result.ExitCode | Should -Be -196608
+            $result.Error | Should -Match 'PowerShell native host error 0xfffd0000'
         }
     }
 }

rust/windows/README.md

@@ -102,14 +102,18 @@ cargo clippy -p powershell-native-windows --all-targets --no-default-features --
 Portable tests cover version formats/overflow, registry-family mappings,
 parameter abbreviations/Unicode dashes, native TPA exclusions, and configuration
 fallback. Windows-only tests cover Automation layout, null dispatch/unknown
-variants, and launcher behavior.
+variants, and launcher behavior. Compile-fail documentation tests enforce private
+variant storage and prevent arbitrary COM interface queries through the safe API.
 The Windows CI jobs build/link both launcher configurations and architectures
 with SDK resources. Pester v5 checks the packaged executable's architecture,
 version resources, native CoreCLR help and missing-runtime errors, successful
 CoreCLR command execution, Unicode/empty/quoted/spaced arguments, positive and
 negative managed exit codes, and native Framework argument rejection.
 Regression coverage also checks BOM-prefixed external-payload configuration
 in both setting orders and byte-oriented redirected help/debug/verbose output.
+CoreCLR startup is also tested with symlinked core-library and console-host
+assemblies; creating Windows symbolic links requires Developer Mode or the
+symbolic-link privilege.
 Framework integration tests compile a COM-visible C# fixture with the installed
 .NET Framework compiler and exercise actual CLR startup, AppDomain activation,
 object unwrapping, argument marshaling, and signed managed exit codes on x86/x64.
@@ -128,7 +132,8 @@ Install-Module Pester -RequiredVersion 5.9.0 -Scope CurrentUser -Repository PSGa
 CI packages these launchers under `artifacts/rust/win-<arch>-<configuration>/`,
 separate from the existing C++ CoreCLR binaries and WSMan plugin under
 `artifacts/cpp/win-<arch>-coreclr/`. Pester NUnit XML is retained on failures.
-The lightweight manual smoke script is also available:
+The lightweight manual smoke script checks CoreCLR help or Framework native
+argument rejection, without requiring an installed managed PowerShell payload:
 
 ```powershell
 ./windows/tests/launcher-smoke.ps1 -ExecutablePath ./target/x86_64-pc-windows-msvc/release/powershell.exe -Configuration coreclr

rust/windows/src/common.rs

@@ -247,7 +247,7 @@ impl HostEnvironment {
                     let entry = entry.ok()?;
                     let path = entry.path();
                     let name = entry.file_name().to_string_lossy().into_owned();
-                    if entry.file_type().ok()?.is_file()
+                    if path.is_file()
                         && name.to_ascii_lowercase().ends_with(".dll")
                         && !exclude_tpa(&name)
                     {

rust/windows/src/hosting.rs

@@ -162,18 +162,31 @@ struct ArrayBound {
 }
 
 #[repr(C)]
-pub union VariantValue {
-    pub pointer: Ptr,
-    pub signed: i64,
-    pub int: i32,
-    pub uint: u32,
+union VariantValue {
+    pointer: Ptr,
+    // Preserve native VARIANT alignment on 32-bit Windows.
+    _signed: i64,
+    uint: u32,
     layout: [usize; 2],
 }
+/// An owning Automation value whose tag and payload can only be set by this module.
+///
+/// ```compile_fail,E0616
+/// use powershell_native_host::hosting::AutomationVariant;
+/// let mut value = AutomationVariant::default();
+/// value.kind = 8;
+/// ```
+///
+/// ```compile_fail,E0616
+/// use powershell_native_host::hosting::AutomationVariant;
+/// let value = AutomationVariant::default();
+/// let _ = &value.value;
+/// ```
 #[repr(C)]
 pub struct AutomationVariant {
-    pub kind: u16,
+    kind: u16,
     reserved: [u16; 3],
-    pub value: VariantValue,
+    value: VariantValue,
 }
 impl Default for AutomationVariant {
     fn default() -> Self {
@@ -328,14 +341,27 @@ const CLSID_COR_RUNTIME: GUID = GUID::from_u128(0xcb2f6723_ab3a_11d2_9c40_00c04f
 const IID_COR_RUNTIME: GUID = GUID::from_u128(0xcb2f6722_ab3a_11d2_9c40_00c04fa30a3e);
 const IID_NULL: GUID = GUID::zeroed();
 
+/// An owning COM reference. Public APIs only return dispatch interfaces;
+/// arbitrary interface queries remain internal.
+///
+/// ```compile_fail,E0624
+/// use powershell_native_host::hosting::ComObject;
+/// use windows::core::GUID;
+/// fn cannot_invoke_unknown(object: &ComObject) {
+///     let unknown = object.query(
+///         &GUID::from_u128(0x00000000_0000_0000_c000_000000000046)
+///     ).unwrap();
+///     let _ = unknown.invoke("Start", &mut []);
+/// }
+/// ```
 pub struct ComObject(Ptr);
 impl ComObject {
     unsafe fn slot(&self, index: usize) -> Ptr {
         *(*(self.0 as *const *const Ptr)).add(index)
     }
     /// # Errors
     /// Returns the HRESULT if the requested COM interface is unavailable.
-    pub fn query(&self, iid: &GUID) -> Result<Self> {
+    fn query(&self, iid: &GUID) -> Result<Self> {
         let query: unsafe extern "system" fn(Ptr, *const GUID, *mut Ptr) -> i32 =
             unsafe { mem::transmute(self.slot(0)) };
         let mut result = ptr::null_mut();

rust/windows/tests/launcher-smoke.ps1

@@ -35,7 +35,7 @@ try {
     $arguments = if ($Configuration -eq 'coreclr') {
         @('-?')
     } else {
-        @('-NoLogo', '-NoProfile', '-NonInteractive', '-Command', 'exit 37')
+        @('-Version', 'invalid')
     }
     foreach ($argument in $arguments) {
         $process.StartInfo.ArgumentList.Add($argument)
@@ -55,8 +55,8 @@ try {
         if ($process.ExitCode -ne -1 -or $output -notmatch 'USAGE: powershell') {
             throw "CoreCLR native help failed ($($process.ExitCode)): $output $errorText"
         }
-    } elseif ($process.ExitCode -ne 37) {
-        throw "Framework host did not execute managed PowerShell ($($process.ExitCode)): $output $errorText"
+    } elseif ($process.ExitCode -ne -196608 -or $errorText -notmatch 'PowerShell native host error 0xfffd0000') {
+        throw "Framework native argument rejection failed ($($process.ExitCode)): $output $errorText"
     }
 } finally {
     if ($started -and -not $process.HasExited) {
@@ -65,4 +65,4 @@ try {
     }
     $process.Dispose()
 }
-'Launcher resources and startup smoke checks passed.'
+'Launcher resources and native smoke checks passed.'