Fix per-user installer directory permissions to resolve Monaco preview handler ACCESS DENIED error

[Copilot]

Problem

When PowerToys is installed using the per-user installer, it installs to %LOCALAPPDATA%\PowerToys (e.g., C:\Users\[username]\AppData\Local\PowerToys). During installation, Windows Installer may set restrictive permissions on this directory that prevent preview handlers from loading their DLLs properly, resulting in "ACCESS DENIED" errors when trying to load PowerToys.MonacoPreviewHandlerCpp.dll.

Root Cause

Preview handlers in Windows run in restricted security contexts through Explorer. When the installation directory has permissions that are too restrictive, these preview handler processes cannot access the required DLL files, causing preview functionality to fail.

Solution

Added a new custom action FixPerUserInstallDirectoryPermissionsCA that:

1. Runs only for per-user installations - System-wide installations don't have this issue
2. Sets appropriate permissions on the installation directory:
   • Current User: Full access (FILE_ALL_ACCESS)
   • Interactive Users group: Read and execute access (FILE_GENERIC_READ | FILE_GENERIC_EXECUTE)
3. Executes at the right time - After files are installed but before registry changes are applied
4. Uses proper inheritance - Permissions are inherited by subdirectories and files

Implementation Details

• Custom Action: Added FixPerUserInstallDirectoryPermissionsCA in CustomAction.cpp
• WiX Integration: Integrated into installation sequence in Product.wxs
• Error Handling: Comprehensive error handling with logging
• Security: Uses Windows security APIs (SetNamedSecurityInfo, SetEntriesInAcl)

Why This Works

• Current User access: Ensures the user who installed PowerToys can access all files
• Interactive Users access: Covers processes running in user sessions, including preview handlers that may run in slightly different security contexts
• Inheritance: Ensures all files and subdirectories get the appropriate permissions
• Timing: Applied after installation but before registration, ensuring the DLLs are accessible when the preview handlers are registered

Changes

• installer/PowerToysSetupCustomActions/CustomAction.cpp - Added the custom action implementation (+112 lines)
• installer/PowerToysSetupCustomActions/CustomAction.def - Exported the function (+1 line)
• installer/PowerToysSetup/Product.wxs - Integrated custom action into installation sequence (+18 lines)

The changes are minimal and surgical, affecting only the per-user installation flow without impacting system-wide installations or existing functionality.

Fixes #28.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.