From 4e6aa460aa6b861b71bf57f2ea193d2a34e0b8be Mon Sep 17 00:00:00 2001
From: DonislawDev <contact@donislawdev.com>
Date: Fri, 25 Sep 2026 09:39:48 +0200
Subject: [PATCH 1/2] fix(mech): start a batch script through the command
 interpreter

Windows starts the command interpreter for a .bat or .cmd target by
itself, as `cmd.exe /c <line>`, with no quotes around the line. The
interpreter keeps the quotes of a line only when it holds exactly one
pair with no special character, and otherwise strips the first quote
and the last one. Measured with a script that writes down what it
received:

- An argument with a space, or a script in a folder with `&` in its
  name: the script never started, and the session reported a target
  that vanished right after injection.
- An empty argument disappeared and moved the others up one place.
- `a&b` gave the script `a` and ran `b` as a separate command.

Both launches now start `<system folder>\cmd.exe /e:ON /v:OFF /c
""<script>" <arguments>"`. Each argument is quoted the way Rust's
standard library quotes one for a batch script, `%` included, so `%OS%`
arrives as those four characters, as it does for a program. `/d` is left
out on purpose, so AutoRun commands still run as they do when the
script is started any other way (ADR-15). The script path is made
absolute first, because the interpreter would resolve a relative one
against the target's working folder.

An argument holding a line break or a zero character is refused before
anything starts, with exit 2, and the dry run refuses it too. The plan
says the hook goes into the command interpreter that runs the script.
Measured on x64 and x86: the interpreter runs at the core's bitness.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     |  10 ++
 README.md                        |   1 +
 crates/cli/src/run/plan.rs       |  58 ++++++---
 crates/cli/tests/batch_script.rs | 106 ++++++++++++++++
 crates/cli/tests/dry_run.rs      |  10 ++
 crates/cli/tests/network.rs      |   7 ++
 crates/mech/src/batch.rs         | 205 +++++++++++++++++++++++++++++++
 crates/mech/src/lib.rs           |  21 +++-
 8 files changed, 397 insertions(+), 21 deletions(-)
 create mode 100644 crates/cli/tests/batch_script.rs
 create mode 100644 crates/mech/src/batch.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 052d20bf..9524862f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,16 @@ Notable changes to Chrono Mock, newest first. The format follows
 
 ### Fixed
 
+- **A batch script as the target lost its arguments, or never started.** Windows starts the command
+  interpreter for a `.bat` or `.cmd` itself and strips quotes from the line it hands over. So an
+  argument with a space, or a script in a folder with `&` in its name, kept the script from starting,
+  and the session said the application vanished right after injection. An empty argument disappeared
+  and moved the others up one place, and `a&b` gave the script `a` and ran `b` as a separate command.
+  The session now starts the interpreter from the system folder itself, and every argument arrives
+  as it was given. `%OS%` stays those four characters, as it does for a program. AutoRun commands
+  from the registry still run, as they do when the script is started any other way. An argument
+  holding a line break is refused before anything starts, with exit 2, and `--dry-run` refuses it
+  too.
 - **`--dry-run` approved sessions the real run refuses.** An impossible `--at` (month 13, 30 February,
   25:61) was printed as the plan and exited 0, while the real run was refused by the core with
   exit 1. A file Windows will not start (a text file, an empty `.exe`, one cut short inside its
diff --git a/README.md b/README.md
index 90672bc2..f10136cd 100644
--- a/README.md
+++ b/README.md
@@ -362,6 +362,7 @@ column says which is which._
 | Python (CPython, incl. PyInstaller) | experimental | measured by hand on x64, not by the suite | Wall clock (time.time, datetime) and the session time zone (time.localtime) are covered. perf_counter, and monotonic on Python 3.13+, are on the high-resolution counter - real by default, accelerated when you opt in with Scale QPC (`--scale-qpc`) |
 | Applications reading time from the network | out of scope by definition | measured on x64, x86 | The audit detects it - every connection attempt made through Windows' own socket layer is observed and warned about, whichever function made it (Winsock, WinHTTP, WinINet, and the .NET, Node.js, Go, Java and Python runtimes). A datagram sent without a connection is not a connection and is not counted. A third-party Winsock provider, rare on current Windows, is not watched |
 | Embedded web engine inside a native app (WebView2, Qt WebEngine) | experimental | measured by hand on a WebView2 host and a Qt WebEngine host (x64), not by the suite | The native hook covers the application and the pages inside it are reached over the engine's debugging port, opened for the session through two environment variables the application inherits. The pages read the session clock at the session rate and follow a speed change and a jump. The engine's helper processes and the renderer's native reads stay on the real clock, so the verdict is PARTIAL and says why. The pages keep the machine's time zone. An elevated application is out of reach - the engine ignores the variables |
+| Batch script (`.bat`, `.cmd`) as the target | experimental (command line) | measured on x64 by the test suite, on x86 by hand | Started through the command interpreter from the system folder, which is the process the session covers, together with everything the script starts. Arguments arrive as given, including spaces, `&`, an empty argument and `%` (`%OS%` stays those four characters). A quote inside an argument arrives doubled, and so does the trailing backslash of an argument that needs quotes, which keeps a script that passes `%*` on to a program correct. The window takes an `.exe` only |
 | Electron / Chromium | experimental (Chromium mode) | measured by hand on an Electron app (x64), not by the suite | A separate mechanism, not injection: the app is launched with a debug port and a clean isolated profile, and its own JS time APIs are put on the session clock over the DevTools protocol - reaching the sandboxed renderer and its Web Workers, where the timer often lives. The session zone follows the host zone (the instant is faked, not the local-time getters) |
 | UWP / MSIX (Store apps) | not supported | declared (not exercised) | Packaging and launch model |
 | ARM64 | out of scope through v1.0 | declared (not exercised) | To be revisited |
diff --git a/crates/cli/src/run/plan.rs b/crates/cli/src/run/plan.rs
index 10156fe7..930e8906 100644
--- a/crates/cli/src/run/plan.rs
+++ b/crates/cli/src/run/plan.rs
@@ -102,25 +102,15 @@ fn inspect_target(target: &str, chromium: bool) -> TargetPath {
     }
 }
 
-/// Whether `CreateProcessW` would start this file, which both mechanisms end in: a program's PE image,
-/// or a batch script. A file that could not be read gets the benefit of the doubt - the plan does not
+/// Whether the session can start this file: a program's PE image, or a batch script, which both
+/// mechanisms start through the command interpreter (`chrono_mech::is_batch_script`, the same test
+/// the launch makes). A file that could not be read gets the benefit of the doubt - the plan does not
 /// know, so it does not refuse (untouchable rule 4).
 ///
-/// A batch script it starts through the command interpreter itself, although Microsoft Learn says the
-/// caller must start `cmd.exe /c` for it. Measured with a script that writes down what it received:
-/// it runs and gets its arguments, spaces in its path or name included. Except when an argument
-/// carries quotes - the interpreter Windows starts then strips the first quote and the last one on
-/// the line, and cannot find the script. That is a fact about the launch, not about the file, so the
-/// plan does not refuse it here.
-///
 /// Only WHETHER it is a program, never its bitness - see `mechanism_text` for why the header's
 /// machine field is not trusted here.
 fn windows_would_start(path: &Path) -> bool {
-    let batch = path
-        .extension()
-        .and_then(|e| e.to_str())
-        .is_some_and(|e| e.eq_ignore_ascii_case("bat") || e.eq_ignore_ascii_case("cmd"));
-    batch || crate::pe::is_pe_image(path) != Some(false)
+    chrono_mech::is_batch_script(path) || crate::pe::is_pe_image(path) != Some(false)
 }
 
 /// The canonical path without the extended-length prefix Windows answers `canonicalize` with. That
@@ -156,9 +146,9 @@ struct Plan<'a> {
     zone_bias_min: i32,
 }
 
-/// Print the plan and start nothing. Exit 0, except for a path that definitely leads to no file or
-/// to a file Windows will not start, which exits 2 - the code a real run gives for the same fact
-/// (docs/08 section 8).
+/// Print the plan and start nothing. Exit 0, except for a path that definitely leads to no file, to a
+/// file Windows will not start, or to a batch script given an argument its launch refuses, which exits
+/// 2 - the code a real run gives for the same fact (docs/08 section 8).
 pub(super) fn dry_run(ra: &RunArgs, spec: &TimeSpec, origin: &TimeOrigin, now_bias: i32) -> i32 {
     // The same pure function the core calls, so the plan names the mechanism the core would choose
     // and not one worked out a second way (ADR-9).
@@ -195,6 +185,14 @@ pub(super) fn dry_run(ra: &RunArgs, spec: &TimeSpec, origin: &TimeOrigin, now_bi
         );
         return 2;
     }
+    // The launch refuses these arguments for a batch script, so the plan does too, with the same code.
+    if matches!(plan.target, TargetPath::Found(_))
+        && chrono_mech::is_batch_script(Path::new(&ra.target))
+        && let Some(problem) = chrono_mech::batch_arguments_problem(&ra.args)
+    {
+        eprintln!("chrono: {problem}, so a real run would refuse to start it (exit 2)");
+        return 2;
+    }
     0
 }
 
@@ -253,6 +251,14 @@ fn mechanism_text(p: &Plan) -> String {
     if p.chromium {
         return "Chromium or Electron over CDP - the folder carries the Chromium runtime".to_string();
     }
+    // The process started is the command interpreter from the system folder, whose bitness is this
+    // core's, and what the audit then reports is that interpreter and whatever the script starts.
+    if chrono_mech::is_batch_script(Path::new(&p.ra.target)) {
+        return format!(
+            "native injection into the command interpreter that runs the script, from the {} core",
+            this_bitness()
+        );
+    }
     // The bitness named here is THIS executable's, never the target's. The target's is read from the
     // running process by chrono-mech, because a .NET AnyCPU image carries IMAGE_FILE_MACHINE_I386 in
     // its header and runs 64-bit anyway - a plan that read the header would refuse targets that work.
@@ -688,4 +694,22 @@ mod tests {
             assert!(mechanism_text(plan).contains("not decided"), "{}", mechanism_text(plan));
         });
     }
+
+    /// A batch script is started through the command interpreter, so that is what the plan says the
+    /// hook goes into - and not that a 32-bit script needs the other build, which means nothing for
+    /// a script.
+    #[test]
+    fn a_batch_script_is_planned_as_the_command_interpreter_that_runs_it() {
+        let dir = crate::testutil::unique_temp_dir("chrono-plan-batch");
+        std::fs::create_dir_all(&dir).expect("scratch dir");
+        let script = dir.join("run.cmd");
+        std::fs::write(&script, "@echo off\r\n").expect("batch file");
+        plan_for(&[&script.display().to_string(), "--at", "2030-01-01T00:00:00"], |plan| {
+            let text = mechanism_text(plan);
+            assert!(text.contains("command interpreter that runs the script"), "{text}");
+            assert!(text.contains(this_bitness()), "{text}");
+            assert!(!text.contains("32-bit target"), "{text}");
+        });
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/cli/tests/batch_script.rs b/crates/cli/tests/batch_script.rs
new file mode 100644
index 00000000..d4b8e94b
--- /dev/null
+++ b/crates/cli/tests/batch_script.rs
@@ -0,0 +1,106 @@
+//! A batch script as the target, run for real: its arguments reach it as they were given, from a
+//! folder whose name holds a space, an ampersand and brackets.
+//!
+//! Found 2026-09-25 by a script that writes down what it received. `CreateProcessW` starts the
+//! command interpreter for a batch file itself, with no quotes around the line, and the interpreter
+//! then strips the first quote and the last one. An argument with a space, or a folder with `&` in
+//! its name, kept the script from starting while the session reported a target that vanished, an
+//! empty argument vanished and shifted the rest, and `a&b` ran its second half as a separate
+//! command. The launch now starts the interpreter itself (`chrono_mech`, `batch.rs`, ADR-15).
+//!
+//! The evidence is the file the script writes, not the exit code: a script that ends at once can
+//! end inside the opening guard window, which is its own verdict (ADR-4).
+
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::{Mutex, MutexGuard};
+
+/// Held by every test here that starts the core. The core allows one session at a time, and the
+/// tests of one file run on parallel threads.
+static REAL_SESSION: Mutex<()> = Mutex::new(());
+
+fn one_real_session_at_a_time() -> MutexGuard<'static, ()> {
+    REAL_SESSION.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
+/// The library the session injects, beside the binary under test. `cargo test` does not build it
+/// (see `dry_run.rs`), so its absence is named rather than read as a failure of the launch.
+fn require_injected_library() {
+    let library = PathBuf::from(env!("CARGO_BIN_EXE_chrono"))
+        .parent()
+        .expect("the binary under test lives in a directory")
+        .join("chrono_hook.dll");
+    assert!(
+        library.is_file(),
+        "this drives a real session and needs {}, which `cargo test` does not build. Run `cargo \
+         build --workspace` first - CI and tools/gates.ps1 both do that.",
+        library.display()
+    );
+}
+
+/// A folder named the way that broke the launch, with a script in it that writes what it got. Six
+/// arguments, each read with `%~N`, which drops the quotes the launch put around it.
+fn script_folder(name: &str) -> (PathBuf, PathBuf) {
+    let dir = std::env::temp_dir().join(format!("chrono batch {name} R&D (x86) {}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).expect("a scratch directory");
+    let script = dir.join("probe script.bat");
+    let body = [
+        "@echo off",
+        "setlocal EnableDelayedExpansion",
+        "set \"a1=%~1\"",
+        "set \"a2=%~2\"",
+        "set \"a3=%~3\"",
+        "set \"a4=%~4\"",
+        "set \"a5=%~5\"",
+        "set \"a6=%~6\"",
+        "> \"%~dp0args.txt\" echo [!a1!][!a2!][!a3!][!a4!][!a5!][!a6!]",
+        "",
+    ]
+    .join("\r\n");
+    std::fs::write(&script, body).expect("the script");
+    (dir, script)
+}
+
+#[test]
+fn a_batch_script_gets_its_arguments_as_they_were_given() {
+    require_injected_library();
+    let _session = one_real_session_at_a_time();
+    let (dir, script) = script_folder("args");
+    let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
+        .args([
+            "run",
+            &script.display().to_string(),
+            "--args",
+            r#""one a" a&b 50% %OS% "" last"#,
+            "--at",
+            "2038-01-19T03:14:07",
+        ])
+        .output()
+        .expect("the tool must run");
+    let said = format!("stdout: {} stderr: {}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+    let got = std::fs::read_to_string(dir.join("args.txt"))
+        .unwrap_or_else(|e| panic!("the script never ran ({e}), so it wrote nothing. {said}"));
+    // A space, an ampersand, a percent sign, a variable's name, an empty argument and one after it,
+    // every one where it was given. `%OS%` stays those four characters, as it does for a program.
+    assert_eq!(got.trim_end(), "[one a][a&b][50%][%OS%][][last]", "{said}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// An argument with a line break would cut the interpreter's line short, so the launch refuses it
+/// with the code of a target that could not be started, and the script never runs.
+#[test]
+fn an_argument_that_would_cut_the_script_line_short_is_refused_before_anything_starts() {
+    require_injected_library();
+    let _session = one_real_session_at_a_time();
+    let (dir, script) = script_folder("refused");
+    let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
+        .args(["run", &script.display().to_string(), "--args", "\"a\nb\"", "--at", "2038-01-19T03:14:07"])
+        .output()
+        .expect("the tool must run");
+    let said = format!("stdout: {} stderr: {}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+    assert_eq!(out.status.code(), Some(2), "{said}");
+    assert!(said.contains("line break"), "the refusal must say why: {said}");
+    assert!(!dir.join("args.txt").exists(), "the script must not have run: {said}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/cli/tests/dry_run.rs b/crates/cli/tests/dry_run.rs
index bc574b88..52e50525 100644
--- a/crates/cli/tests/dry_run.rs
+++ b/crates/cli/tests/dry_run.rs
@@ -256,6 +256,16 @@ fn a_plan_refuses_what_the_run_would_refuse_and_nothing_else() {
         .expect("the tool must run");
     assert_eq!(out.status.code(), Some(0), "a batch script is started by Windows: {}", String::from_utf8_lossy(&out.stderr));
 
+    // The same script given an argument its launch refuses (a line break would cut the interpreter's
+    // line short): the plan refuses it too, with the code the run gives (batch_script.rs).
+    let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
+        .args(["run", &script.display().to_string(), "--args", "\"a\nb\"", "--at", "2038-01-19T03:14:07", "--dry-run"])
+        .output()
+        .expect("the tool must run");
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert_eq!(out.status.code(), Some(2), "{stderr}");
+    assert!(stderr.contains("line break"), "{stderr}");
+
     // A library is a whole PE image, and still not a program: its header says so, and Windows
     // refuses it. The state, not only the code, because a missing file exits 2 as well.
     let library = injected_library();
diff --git a/crates/cli/tests/network.rs b/crates/cli/tests/network.rs
index 2f29e795..6445e76b 100644
--- a/crates/cli/tests/network.rs
+++ b/crates/cli/tests/network.rs
@@ -163,6 +163,13 @@ const ALLOWED: &[(&str, &str, &str)] = &[
          launch a file Windows will not start - the real runs are what prove the plans can fail. \
          None reaches past this machine",
     ),
+    (
+        "crates/cli/tests/batch_script.rs",
+        "spawn",
+        "runs the built binary on a batch script in a scratch folder, to see the arguments reach the \
+         script as they were given and a line break refused before anything starts. The script only \
+         writes a file beside itself, and nothing reaches past this machine",
+    ),
     (
         "crates/cli/tests/usage.rs",
         "spawn",
diff --git a/crates/mech/src/batch.rs b/crates/mech/src/batch.rs
new file mode 100644
index 00000000..150cb1ad
--- /dev/null
+++ b/crates/mech/src/batch.rs
@@ -0,0 +1,205 @@
+//! Starting a batch script as a target.
+//!
+//! `CreateProcessW` given a `.bat` or a `.cmd` starts the command interpreter itself, as
+//! `cmd.exe /c <command line>`, with no quotes around the line (measured through `%CMDCMDLINE%`).
+//! The interpreter keeps the quotes of that line only when it holds exactly one pair, with no special
+//! character inside it, and otherwise strips the first quote and the last one (Microsoft Learn,
+//! `cmd`). The line always holds the pair around the script, so any other quote broke it: an
+//! argument with a space, an empty one, or a script in a folder with `&` in its name kept the script
+//! from starting, with the session reporting a target that vanished, an empty argument vanished and
+//! shifted the rest, and `a&b` ran its second half as a command of its own.
+//!
+//! Microsoft Learn says the caller must start the interpreter for a batch file, and this does:
+//! `cmd.exe /e:ON /v:OFF /c ""<script>" <arguments>"`, whose outer pair is the one the interpreter
+//! strips. Each argument is quoted the way Rust's standard library quotes one for a batch script
+//! (`append_bat_arg` in `library/std/src/sys/args/windows.rs`, reworked after CVE-2024-24576),
+//! including its handling of `%`. The switches are the two the arguments need and no more (ADR-15):
+//! `/e:ON` because that `%` handling works through a command extension, and `/v:OFF` so a `!` in an
+//! argument is not expanded. Rust also passes `/d`, which skips the AutoRun commands in the registry.
+//! It is left out on purpose, so the script runs in the setting it has when started any other way.
+
+use std::path::Path;
+
+use windows::Win32::System::SystemInformation::GetSystemDirectoryW;
+
+/// Whether `CreateProcessW` would hand this file to the command interpreter: a `.bat` or a `.cmd`,
+/// in any case.
+pub fn is_batch_script(path: &Path) -> bool {
+    path.extension()
+        .and_then(|e| e.to_str())
+        .is_some_and(|e| e.eq_ignore_ascii_case("bat") || e.eq_ignore_ascii_case("cmd"))
+}
+
+/// Why these arguments cannot be given to a batch script, or `None` when they can. A line break
+/// ends the interpreter's command line where it stands, and a zero character ends the string
+/// `CreateProcessW` reads, so either would hand the script less than it was given.
+pub fn batch_arguments_problem(args: &[String]) -> Option<String> {
+    let broken = args.iter().find(|a| a.contains(['\r', '\n', '\0']))?;
+    Some(format!(
+        "the argument {broken:?} holds a line break or a zero character, which would cut the command \
+         line of a batch script short"
+    ))
+}
+
+/// The application and the command line that start `script` through the command interpreter.
+///
+/// The script path is made absolute first. `CreateProcessW` resolved a relative one against this
+/// process's folder, while the interpreter would resolve it against the target's working folder,
+/// which `--cwd` can move.
+pub(crate) fn interpreter_line(script: &str, args: &[String]) -> Result<(String, String), String> {
+    if let Some(problem) = batch_arguments_problem(args) {
+        return Err(problem);
+    }
+    let script = user_path(script)?;
+    let mut line = format!("cmd.exe /e:ON /v:OFF /c \"\"{script}\"");
+    for arg in args {
+        line.push(' ');
+        push_batch_arg(&mut line, arg);
+    }
+    line.push('"');
+    Ok((command_interpreter()?, line))
+}
+
+/// The interpreter in the system folder, never one found by a search: a `cmd.exe` planted in the
+/// working folder would otherwise run in its place.
+fn command_interpreter() -> Result<String, String> {
+    let mut buffer = [0u16; 260];
+    // SAFETY: the buffer is ours and its length goes with it. The call writes at most that much and
+    // returns how much it wrote, or the size it needs when that is more.
+    let written = unsafe { GetSystemDirectoryW(Some(&mut buffer)) } as usize;
+    let folder = buffer
+        .get(..written)
+        .filter(|_| written > 0 && written < buffer.len())
+        .ok_or("GetSystemDirectoryW did not name the system folder")?;
+    Ok(format!(r"{}\cmd.exe", String::from_utf16_lossy(folder)))
+}
+
+/// The script path, absolute and without a verbatim prefix, which the interpreter cannot run a script
+/// by. `\\?\C:\x` names `C:\x` and `\\?\UNC\host\share` names `\\host\share`. Any other verbatim form
+/// is left as it is, and the interpreter refuses it as it did before.
+fn user_path(script: &str) -> Result<String, String> {
+    let absolute = std::path::absolute(script)
+        .map_err(|e| format!("the script path '{script}' cannot be made absolute: {e}"))?;
+    let text = absolute.to_string_lossy().into_owned();
+    // A quote would close the pair around the script. Windows allows none in a file name, so such a
+    // path names no file, and it is refused here rather than handed to the interpreter half-quoted.
+    if text.contains('"') {
+        return Err(format!("the script path '{script}' holds a quote, which no Windows file name can"));
+    }
+    if let Some(rest) = text.strip_prefix(r"\\?\UNC\") {
+        return Ok(format!(r"\\{rest}"));
+    }
+    let drive = text
+        .strip_prefix(r"\\?\")
+        .filter(|rest| matches!(rest.as_bytes(), [letter, b':', b'\\', ..] if letter.is_ascii_alphabetic()))
+        .map(str::to_string);
+    Ok(drive.unwrap_or(text))
+}
+
+/// One argument as the batch script reads it back: bare when it is only letters, digits and a few
+/// safe marks, quoted otherwise, with a quote inside it doubled and the backslashes before a quote
+/// doubled. A `%` is followed by an empty substring of `%cd%`, which the interpreter expands to
+/// nothing, so that `%OS%` reaches the script as those four characters and not as the variable. A
+/// trailing backslash forces the quotes, so a script that quotes `%~1` again does not escape its own
+/// closing quote.
+fn push_batch_arg(line: &mut String, arg: &str) {
+    const UNQUOTED: &str = r"#$*+-./:?@\_";
+    let quote = arg.is_empty()
+        || arg.ends_with('\\')
+        || arg
+            .chars()
+            .any(|c| (c.is_ascii() && !(c.is_ascii_alphanumeric() || UNQUOTED.contains(c))) || c.is_control());
+    if quote {
+        line.push('"');
+    }
+    let mut backslashes = 0usize;
+    for c in arg.chars() {
+        if c == '\\' {
+            backslashes += 1;
+        } else {
+            if c == '"' {
+                line.extend(std::iter::repeat_n('\\', backslashes));
+                line.push('"');
+            } else if c == '%' {
+                line.push_str("%%cd:~,");
+            }
+            backslashes = 0;
+        }
+        line.push(c);
+    }
+    if quote {
+        line.extend(std::iter::repeat_n('\\', backslashes));
+        line.push('"');
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_batch_script_is_known_by_its_extension_in_any_case() {
+        for yes in ["run.bat", "RUN.BAT", r"C:\a b\x.Cmd", "x.y.bat"] {
+            assert!(is_batch_script(Path::new(yes)), "{yes}");
+        }
+        for no in ["app.exe", "bat", "run.bat.exe", "run.batch", "run.cm"] {
+            assert!(!is_batch_script(Path::new(no)), "{no}");
+        }
+    }
+
+    /// Each row measured with a script that writes back `%~1`, through the interpreter started this
+    /// way (tools/probes/pe-edge, 2026-09-25): what the right-hand side gives is what the script read.
+    #[test]
+    fn each_argument_is_quoted_so_the_script_reads_it_back() {
+        for (arg, quoted) in [
+            ("two", "two"),
+            (r"C:\path\file", r"C:\path\file"),
+            ("one a", "\"one a\""),
+            ("a&b", "\"a&b\""),
+            ("50%", "\"50%%cd:~,%\""),
+            ("%OS%", "\"%%cd:~,%OS%%cd:~,%\""),
+            ("", "\"\""),
+            (r"C:\dir\", r#""C:\dir\\""#),
+            ("say \"hi\"", "\"say \"\"hi\"\"\""),
+            ("a!b", "\"a!b\""),
+        ] {
+            let mut line = String::new();
+            push_batch_arg(&mut line, arg);
+            assert_eq!(line, quoted, "{arg:?}");
+        }
+    }
+
+    /// The whole line: the interpreter from the system folder, the two switches, and the outer pair of
+    /// quotes around the script and its arguments, which is the pair the interpreter strips.
+    #[test]
+    fn the_script_runs_through_the_interpreter_with_the_line_in_an_outer_pair_of_quotes() {
+        let (app, line) = interpreter_line(r"C:\R&D (x86)\run it.bat", &["one a".to_string(), "x".to_string()])
+            .expect("a line");
+        assert!(app.to_ascii_lowercase().ends_with(r"\system32\cmd.exe"), "{app}");
+        assert_eq!(line, r#"cmd.exe /e:ON /v:OFF /c ""C:\R&D (x86)\run it.bat" "one a" x""#);
+        let (_, bare) = interpreter_line(r"C:\x\run.bat", &[]).expect("a line");
+        assert_eq!(bare, r#"cmd.exe /e:ON /v:OFF /c ""C:\x\run.bat"""#);
+        // AutoRun stays (ADR-15): the switch that would skip it is not on the line.
+        assert!(!line.contains("/d"), "{line}");
+    }
+
+    #[test]
+    fn the_script_path_is_absolute_and_never_verbatim() {
+        let here = std::env::current_dir().expect("a current folder");
+        let (_, relative) = interpreter_line("run.bat", &[]).expect("a line");
+        assert!(relative.contains(&format!("\"{}\"", here.join("run.bat").display())), "{relative}");
+        assert_eq!(user_path(r"\\?\C:\x\run.bat").unwrap(), r"C:\x\run.bat");
+        assert_eq!(user_path(r"\\?\UNC\host\share\run.bat").unwrap(), r"\\host\share\run.bat");
+        assert!(user_path(r#"C:\x"y\run.bat"#).is_err(), "a quote would close the pair around the script");
+    }
+
+    #[test]
+    fn an_argument_that_would_cut_the_line_short_is_refused() {
+        for bad in ["a\nb", "a\rb", "a\0b"] {
+            let args = vec!["fine".to_string(), bad.to_string()];
+            assert!(batch_arguments_problem(&args).is_some(), "{bad:?}");
+            assert!(interpreter_line(r"C:\x\run.bat", &args).is_err(), "{bad:?}");
+        }
+        assert!(batch_arguments_problem(&["one a".to_string(), String::new()]).is_none());
+    }
+}
diff --git a/crates/mech/src/lib.rs b/crates/mech/src/lib.rs
index c00ee157..a75b36ec 100644
--- a/crates/mech/src/lib.rs
+++ b/crates/mech/src/lib.rs
@@ -11,11 +11,13 @@
 //! The tool injects its OWN probes on the host - injecting into third-party or system
 //! processes stays on the VM or requires explicit consent.
 
+mod batch;
 mod environment;
 mod listeners;
 mod policy;
 mod tree;
 
+pub use batch::{batch_arguments_problem, is_batch_script};
 pub use environment::{current_environment, encode_block, environment_block, merge_entries};
 pub use listeners::{listening_sockets, Listener, IPV4_ANY_ADDR, IPV4_LOOPBACK_ADDR};
 pub use policy::webview2_arguments_policy_present;
@@ -645,11 +647,10 @@ impl Drop for PlainChild {
 /// hooked launch builds, the working folder, and the same environment treatment. The one way a
 /// probe starts a host the channel then has to find.
 pub fn launch_plain(target: &Target) -> Result<PlainChild, String> {
+    let (mut app, mut cmdline) = launch_line(target)?;
     // SAFETY: the same call `prepare` makes with the same buffers, minus the suspend flag. The
     // thread handle is closed at once - nothing here resumes or inspects the thread.
     unsafe {
-        let mut app = to_wide(target.path);
-        let mut cmdline = build_command_line(target.path, target.args);
         let cwd_wide = target.cwd.map(to_wide);
         let cwd_ptr = cwd_wide
             .as_ref()
@@ -680,6 +681,17 @@ pub fn launch_plain(target: &Target) -> Result<PlainChild, String> {
     }
 }
 
+/// The application and the command line `CreateProcessW` is given for a target: the target itself
+/// with its arguments quoted for the C runtime, or, for a batch script, the command interpreter with
+/// the script and its arguments quoted for it (see `batch`). One definition for both launches.
+fn launch_line(target: &Target) -> Result<(Vec<u16>, Vec<u16>), String> {
+    if is_batch_script(Path::new(target.path)) {
+        let (app, line) = batch::interpreter_line(target.path, target.args)?;
+        return Ok((to_wide(&app), to_wide(&line)));
+    }
+    Ok((to_wide(target.path), build_command_line(target.path, target.args)))
+}
+
 /// The `lpEnvironment` argument and its creation flag for a launch: null and no flag when there is
 /// nothing to add (the child inherits, exactly as before), or a Unicode block with its flag. The
 /// block is returned so it outlives the call - the pointer is into it.
@@ -1109,6 +1121,9 @@ pub fn prepare(spec: &SessionSpec, target: &Target, hook_dll: &Path) -> Result<P
         TimeMode::Multiplier(m) => m,
     };
     let dll_wide = to_wide(&hook_dll.to_string_lossy());
+    // Before the lock and the control block, so a target that cannot be given its command line leaves
+    // nothing behind to undo.
+    let (mut app, mut cmdline) = launch_line(target).map_err(PrepareError::Launch)?;
 
     unsafe {
         // 0. Session lock, before anything shared is touched. Everything below - the decision to
@@ -1183,8 +1198,6 @@ pub fn prepare(spec: &SessionSpec, target: &Target, hook_dll: &Path) -> Result<P
         write_core_pid(ctl, GetCurrentProcessId());
 
         // 2. Launch SUSPENDED so the hook lands before the first instruction.
-        let mut app = to_wide(target.path);
-        let mut cmdline = build_command_line(target.path, target.args);
         let cwd_wide = target.cwd.map(to_wide);
         let cwd_ptr = cwd_wide
             .as_ref()

From b68e229c24a07c87321c54921b0d9c3a059dceef Mon Sep 17 00:00:00 2001
From: DonislawDev <contact@donislawdev.com>
Date: Fri, 25 Sep 2026 09:57:53 +0200
Subject: [PATCH 2/2] fix(mech): protect % in the script path, refuse a line
 cmd will not run

Review round on the batch-script launch, each point measured first.

- The interpreter expands the whole line, the script's path included, so
  a script in a folder named `%OS%` or `%PATH%x` was not found and the
  session said the target vanished. The path now gets the same `%`
  handling as an argument.
- A line longer than the interpreter takes was answered with "The
  command line is too long." and again ended as a target that vanished.
  Measured through CreateProcessW: 8191 UTF-16 units start the script,
  8192 do not, and the raw length is what counts, not the length after
  expansion. Such a launch is now refused before anything starts, with
  exit 2, through the same check the dry run uses.
- CHANGELOG: the entry no longer says every argument arrives exactly as
  given. It names the two that arrive doubled, as the README does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     | 13 +++--
 README.md                        |  2 +-
 crates/cli/src/run/plan.rs       |  9 ++--
 crates/cli/tests/batch_script.rs | 32 ++++++++-----
 crates/cli/tests/dry_run.rs      | 21 +++++----
 crates/cli/tests/network.rs      |  4 +-
 crates/mech/src/batch.rs         | 81 ++++++++++++++++++++++++--------
 crates/mech/src/lib.rs           |  2 +-
 8 files changed, 110 insertions(+), 54 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9524862f..813eea6d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -48,11 +48,14 @@ Notable changes to Chrono Mock, newest first. The format follows
   argument with a space, or a script in a folder with `&` in its name, kept the script from starting,
   and the session said the application vanished right after injection. An empty argument disappeared
   and moved the others up one place, and `a&b` gave the script `a` and ran `b` as a separate command.
-  The session now starts the interpreter from the system folder itself, and every argument arrives
-  as it was given. `%OS%` stays those four characters, as it does for a program. AutoRun commands
-  from the registry still run, as they do when the script is started any other way. An argument
-  holding a line break is refused before anything starts, with exit 2, and `--dry-run` refuses it
-  too.
+  The session now starts the interpreter from the system folder itself. Arguments with spaces, `&`,
+  `%` or nothing in them arrive as they were given, and `%OS%` stays those four characters, as it
+  does for a program, in an argument and in the script's own path. Two things arrive doubled, as the
+  interpreter cannot take them otherwise: a quote inside an argument, and the trailing backslash of
+  an argument that needs quotes. AutoRun commands from the registry still run, as they do when the
+  script is started any other way. An argument holding a line break, and a command line longer
+  than the interpreter's 8191 characters, are refused before anything starts, with exit 2, and
+  `--dry-run` refuses them too.
 - **`--dry-run` approved sessions the real run refuses.** An impossible `--at` (month 13, 30 February,
   25:61) was printed as the plan and exited 0, while the real run was refused by the core with
   exit 1. A file Windows will not start (a text file, an empty `.exe`, one cut short inside its
diff --git a/README.md b/README.md
index f10136cd..50f3ddd8 100644
--- a/README.md
+++ b/README.md
@@ -362,7 +362,7 @@ column says which is which._
 | Python (CPython, incl. PyInstaller) | experimental | measured by hand on x64, not by the suite | Wall clock (time.time, datetime) and the session time zone (time.localtime) are covered. perf_counter, and monotonic on Python 3.13+, are on the high-resolution counter - real by default, accelerated when you opt in with Scale QPC (`--scale-qpc`) |
 | Applications reading time from the network | out of scope by definition | measured on x64, x86 | The audit detects it - every connection attempt made through Windows' own socket layer is observed and warned about, whichever function made it (Winsock, WinHTTP, WinINet, and the .NET, Node.js, Go, Java and Python runtimes). A datagram sent without a connection is not a connection and is not counted. A third-party Winsock provider, rare on current Windows, is not watched |
 | Embedded web engine inside a native app (WebView2, Qt WebEngine) | experimental | measured by hand on a WebView2 host and a Qt WebEngine host (x64), not by the suite | The native hook covers the application and the pages inside it are reached over the engine's debugging port, opened for the session through two environment variables the application inherits. The pages read the session clock at the session rate and follow a speed change and a jump. The engine's helper processes and the renderer's native reads stay on the real clock, so the verdict is PARTIAL and says why. The pages keep the machine's time zone. An elevated application is out of reach - the engine ignores the variables |
-| Batch script (`.bat`, `.cmd`) as the target | experimental (command line) | measured on x64 by the test suite, on x86 by hand | Started through the command interpreter from the system folder, which is the process the session covers, together with everything the script starts. Arguments arrive as given, including spaces, `&`, an empty argument and `%` (`%OS%` stays those four characters). A quote inside an argument arrives doubled, and so does the trailing backslash of an argument that needs quotes, which keeps a script that passes `%*` on to a program correct. The window takes an `.exe` only |
+| Batch script (`.bat`, `.cmd`) as the target | experimental (command line) | measured on x64 by the test suite, on x86 by hand | Started through the command interpreter from the system folder, which is the process the session covers, together with everything the script starts. Arguments arrive as given, including spaces, `&`, an empty argument and `%` (`%OS%` stays those four characters). A quote inside an argument arrives doubled, and so does the trailing backslash of an argument that needs quotes, which keeps a script that passes `%*` on to a program correct. A command line longer than the interpreter's 8191 characters is refused before anything starts. The window takes an `.exe` only |
 | Electron / Chromium | experimental (Chromium mode) | measured by hand on an Electron app (x64), not by the suite | A separate mechanism, not injection: the app is launched with a debug port and a clean isolated profile, and its own JS time APIs are put on the session clock over the DevTools protocol - reaching the sandboxed renderer and its Web Workers, where the timer often lives. The session zone follows the host zone (the instant is faked, not the local-time getters) |
 | UWP / MSIX (Store apps) | not supported | declared (not exercised) | Packaging and launch model |
 | ARM64 | out of scope through v1.0 | declared (not exercised) | To be revisited |
diff --git a/crates/cli/src/run/plan.rs b/crates/cli/src/run/plan.rs
index 930e8906..5f61615c 100644
--- a/crates/cli/src/run/plan.rs
+++ b/crates/cli/src/run/plan.rs
@@ -147,8 +147,8 @@ struct Plan<'a> {
 }
 
 /// Print the plan and start nothing. Exit 0, except for a path that definitely leads to no file, to a
-/// file Windows will not start, or to a batch script given an argument its launch refuses, which exits
-/// 2 - the code a real run gives for the same fact (docs/08 section 8).
+/// file Windows will not start, or to a batch script its launch would refuse, which exits 2 - the code
+/// a real run gives for the same fact (docs/08 section 8).
 pub(super) fn dry_run(ra: &RunArgs, spec: &TimeSpec, origin: &TimeOrigin, now_bias: i32) -> i32 {
     // The same pure function the core calls, so the plan names the mechanism the core would choose
     // and not one worked out a second way (ADR-9).
@@ -185,10 +185,11 @@ pub(super) fn dry_run(ra: &RunArgs, spec: &TimeSpec, origin: &TimeOrigin, now_bi
         );
         return 2;
     }
-    // The launch refuses these arguments for a batch script, so the plan does too, with the same code.
+    // The launch refuses some batch launches (a line break in an argument, a line longer than the
+    // interpreter runs), so the plan does too, through the same checks and with the same code.
     if matches!(plan.target, TargetPath::Found(_))
         && chrono_mech::is_batch_script(Path::new(&ra.target))
-        && let Some(problem) = chrono_mech::batch_arguments_problem(&ra.args)
+        && let Some(problem) = chrono_mech::batch_launch_problem(&ra.target, &ra.args)
     {
         eprintln!("chrono: {problem}, so a real run would refuse to start it (exit 2)");
         return 2;
diff --git a/crates/cli/tests/batch_script.rs b/crates/cli/tests/batch_script.rs
index d4b8e94b..cdb67c43 100644
--- a/crates/cli/tests/batch_script.rs
+++ b/crates/cli/tests/batch_script.rs
@@ -1,5 +1,5 @@
 //! A batch script as the target, run for real: its arguments reach it as they were given, from a
-//! folder whose name holds a space, an ampersand and brackets.
+//! folder whose name holds a space, an ampersand, brackets and a literal `%OS%`.
 //!
 //! Found 2026-09-25 by a script that writes down what it received. `CreateProcessW` starts the
 //! command interpreter for a batch file itself, with no quotes around the line, and the interpreter
@@ -41,7 +41,9 @@ fn require_injected_library() {
 /// A folder named the way that broke the launch, with a script in it that writes what it got. Six
 /// arguments, each read with `%~N`, which drops the quotes the launch put around it.
 fn script_folder(name: &str) -> (PathBuf, PathBuf) {
-    let dir = std::env::temp_dir().join(format!("chrono batch {name} R&D (x86) {}", std::process::id()));
+    // `%OS%` is part of the folder's name, not a variable: the interpreter expands the whole line, the
+    // script's path included, and a script in such a folder was not found (measured).
+    let dir = std::env::temp_dir().join(format!("chrono batch {name} R&D (x86) %OS% {}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).expect("a scratch directory");
     let script = dir.join("probe script.bat");
@@ -87,20 +89,24 @@ fn a_batch_script_gets_its_arguments_as_they_were_given() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
-/// An argument with a line break would cut the interpreter's line short, so the launch refuses it
-/// with the code of a target that could not be started, and the script never runs.
+/// Two launches the interpreter would not run as given: an argument with a line break, which cuts
+/// its line short, and a line longer than the 8 191 units it takes, which it answers with "The
+/// command line is too long." Both used to end as a target that vanished. Both are refused before
+/// anything starts, with the code of a target that could not be started, and the script never runs.
 #[test]
-fn an_argument_that_would_cut_the_script_line_short_is_refused_before_anything_starts() {
+fn a_launch_the_interpreter_would_not_run_is_refused_before_anything_starts() {
     require_injected_library();
     let _session = one_real_session_at_a_time();
     let (dir, script) = script_folder("refused");
-    let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
-        .args(["run", &script.display().to_string(), "--args", "\"a\nb\"", "--at", "2038-01-19T03:14:07"])
-        .output()
-        .expect("the tool must run");
-    let said = format!("stdout: {} stderr: {}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
-    assert_eq!(out.status.code(), Some(2), "{said}");
-    assert!(said.contains("line break"), "the refusal must say why: {said}");
-    assert!(!dir.join("args.txt").exists(), "the script must not have run: {said}");
+    for (args, why) in [("\"a\nb\"".to_string(), "line break"), ("a".repeat(8200), "8191")] {
+        let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
+            .args(["run", &script.display().to_string(), "--args", &args, "--at", "2038-01-19T03:14:07"])
+            .output()
+            .expect("the tool must run");
+        let said = format!("stdout: {} stderr: {}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+        assert_eq!(out.status.code(), Some(2), "{why}: {said}");
+        assert!(said.contains(why), "the refusal must say why: {said}");
+        assert!(!dir.join("args.txt").exists(), "the script must not have run: {said}");
+    }
     let _ = std::fs::remove_dir_all(&dir);
 }
diff --git a/crates/cli/tests/dry_run.rs b/crates/cli/tests/dry_run.rs
index 52e50525..e1d2fe3d 100644
--- a/crates/cli/tests/dry_run.rs
+++ b/crates/cli/tests/dry_run.rs
@@ -256,15 +256,18 @@ fn a_plan_refuses_what_the_run_would_refuse_and_nothing_else() {
         .expect("the tool must run");
     assert_eq!(out.status.code(), Some(0), "a batch script is started by Windows: {}", String::from_utf8_lossy(&out.stderr));
 
-    // The same script given an argument its launch refuses (a line break would cut the interpreter's
-    // line short): the plan refuses it too, with the code the run gives (batch_script.rs).
-    let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
-        .args(["run", &script.display().to_string(), "--args", "\"a\nb\"", "--at", "2038-01-19T03:14:07", "--dry-run"])
-        .output()
-        .expect("the tool must run");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(out.status.code(), Some(2), "{stderr}");
-    assert!(stderr.contains("line break"), "{stderr}");
+    // The same script given a launch the interpreter would not run (a line break that cuts its line
+    // short, a line longer than it takes): the plan refuses both too, with the code the run gives
+    // (batch_script.rs).
+    for (args, why) in [("\"a\nb\"".to_string(), "line break"), ("a".repeat(8200), "8191")] {
+        let out = Command::new(env!("CARGO_BIN_EXE_chrono"))
+            .args(["run", &script.display().to_string(), "--args", &args, "--at", "2038-01-19T03:14:07", "--dry-run"])
+            .output()
+            .expect("the tool must run");
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        assert_eq!(out.status.code(), Some(2), "{why}: {stderr}");
+        assert!(stderr.contains(why), "{why}: {stderr}");
+    }
 
     // A library is a whole PE image, and still not a program: its header says so, and Windows
     // refuses it. The state, not only the code, because a missing file exits 2 as well.
diff --git a/crates/cli/tests/network.rs b/crates/cli/tests/network.rs
index 6445e76b..77f004bb 100644
--- a/crates/cli/tests/network.rs
+++ b/crates/cli/tests/network.rs
@@ -167,8 +167,8 @@ const ALLOWED: &[(&str, &str, &str)] = &[
         "crates/cli/tests/batch_script.rs",
         "spawn",
         "runs the built binary on a batch script in a scratch folder, to see the arguments reach the \
-         script as they were given and a line break refused before anything starts. The script only \
-         writes a file beside itself, and nothing reaches past this machine",
+         script as they were given and a launch the interpreter would not run refused before anything \
+         starts. The script only writes a file beside itself, and nothing reaches past this machine",
     ),
     (
         "crates/cli/tests/usage.rs",
diff --git a/crates/mech/src/batch.rs b/crates/mech/src/batch.rs
index 150cb1ad..feaf7618 100644
--- a/crates/mech/src/batch.rs
+++ b/crates/mech/src/batch.rs
@@ -30,34 +30,57 @@ pub fn is_batch_script(path: &Path) -> bool {
         .is_some_and(|e| e.eq_ignore_ascii_case("bat") || e.eq_ignore_ascii_case("cmd"))
 }
 
-/// Why these arguments cannot be given to a batch script, or `None` when they can. A line break
-/// ends the interpreter's command line where it stands, and a zero character ends the string
-/// `CreateProcessW` reads, so either would hand the script less than it was given.
-pub fn batch_arguments_problem(args: &[String]) -> Option<String> {
-    let broken = args.iter().find(|a| a.contains(['\r', '\n', '\0']))?;
-    Some(format!(
-        "the argument {broken:?} holds a line break or a zero character, which would cut the command \
-         line of a batch script short"
-    ))
+/// The longest command line the interpreter runs, in UTF-16 units, counted before it expands
+/// anything. Measured through `CreateProcessW` (tools/probes/pe-edge): a line of 8 191 starts the
+/// script, one of 8 192 gets "The command line is too long." and the script never runs. A line of
+/// 8 200 made mostly of `%` handling, 1 200 once expanded, fails too, so the raw length is what counts.
+const INTERPRETER_LINE_MAX: usize = 8191;
+
+/// Why this script cannot be started with these arguments, or `None` when it can: the same checks
+/// the launch makes, for a plan to refuse what the launch would refuse.
+pub fn batch_launch_problem(script: &str, args: &[String]) -> Option<String> {
+    batch_line(script, args).err()
 }
 
 /// The application and the command line that start `script` through the command interpreter.
-///
-/// The script path is made absolute first. `CreateProcessW` resolved a relative one against this
-/// process's folder, while the interpreter would resolve it against the target's working folder,
-/// which `--cwd` can move.
 pub(crate) fn interpreter_line(script: &str, args: &[String]) -> Result<(String, String), String> {
-    if let Some(problem) = batch_arguments_problem(args) {
-        return Err(problem);
+    let line = batch_line(script, args)?;
+    Ok((command_interpreter()?, line))
+}
+
+/// The interpreter's command line for `script` and `args`, or why there is none.
+///
+/// A line break ends the line where it stands and a zero character ends the string `CreateProcessW`
+/// reads, so either would hand the script less than it was given. A line longer than the
+/// interpreter takes never starts the script. Both are refused here, before anything starts, instead
+/// of ending as a target that vanished.
+///
+/// The script path is made absolute. `CreateProcessW` resolved a relative one against this process's
+/// folder, while the interpreter would resolve it against the target's working folder, which `--cwd`
+/// can move. A `%` in the path gets the same handling as one in an argument, because the interpreter
+/// expands the whole line: a script in a folder named `%OS%` was not found (measured).
+fn batch_line(script: &str, args: &[String]) -> Result<String, String> {
+    if let Some(broken) = args.iter().find(|a| a.contains(['\r', '\n', '\0'])) {
+        return Err(format!(
+            "the argument {broken:?} holds a line break or a zero character, which would cut the \
+             command line of a batch script short"
+        ));
     }
-    let script = user_path(script)?;
+    let script = user_path(script)?.replace('%', "%%cd:~,%");
     let mut line = format!("cmd.exe /e:ON /v:OFF /c \"\"{script}\"");
     for arg in args {
         line.push(' ');
         push_batch_arg(&mut line, arg);
     }
     line.push('"');
-    Ok((command_interpreter()?, line))
+    let length = line.encode_utf16().count();
+    if length > INTERPRETER_LINE_MAX {
+        return Err(format!(
+            "the command line for this batch script is {length} characters, and the command \
+             interpreter runs at most {INTERPRETER_LINE_MAX} - shorten the arguments or the script's path"
+        ));
+    }
+    Ok(line)
 }
 
 /// The interpreter in the system folder, never one found by a search: a `cmd.exe` planted in the
@@ -197,9 +220,29 @@ mod tests {
     fn an_argument_that_would_cut_the_line_short_is_refused() {
         for bad in ["a\nb", "a\rb", "a\0b"] {
             let args = vec!["fine".to_string(), bad.to_string()];
-            assert!(batch_arguments_problem(&args).is_some(), "{bad:?}");
+            assert!(batch_launch_problem(r"C:\x\run.bat", &args).is_some(), "{bad:?}");
             assert!(interpreter_line(r"C:\x\run.bat", &args).is_err(), "{bad:?}");
         }
-        assert!(batch_arguments_problem(&["one a".to_string(), String::new()]).is_none());
+        assert!(batch_launch_problem(r"C:\x\run.bat", &["one a".to_string(), String::new()]).is_none());
+    }
+
+    /// The interpreter expands the whole line, the script's path included, so a folder named `%OS%`
+    /// gets the same handling as an argument that holds it.
+    #[test]
+    fn a_percent_sign_in_the_script_path_is_not_expanded() {
+        let line = batch_line(r"C:\T\%OS%\run.bat", &[]).expect("a line");
+        assert_eq!(line, r#"cmd.exe /e:ON /v:OFF /c ""C:\T\%%cd:~,%OS%%cd:~,%\run.bat"""#);
+    }
+
+    /// 8 191 units start the script and 8 192 do not (measured), so the refusal falls exactly between.
+    #[test]
+    fn a_line_longer_than_the_interpreter_runs_is_refused_and_one_at_the_limit_is_not() {
+        let script = r"C:\x\run.bat";
+        let empty = batch_line(script, &["a".to_string()]).expect("a line").encode_utf16().count() - 1;
+        let at_limit = vec!["a".repeat(INTERPRETER_LINE_MAX - empty)];
+        assert_eq!(batch_line(script, &at_limit).expect("the longest line").encode_utf16().count(), INTERPRETER_LINE_MAX);
+        let over = vec!["a".repeat(INTERPRETER_LINE_MAX - empty + 1)];
+        let refusal = batch_launch_problem(script, &over).expect("one unit too long");
+        assert!(refusal.contains("8192") && refusal.contains("8191"), "{refusal}");
     }
 }
diff --git a/crates/mech/src/lib.rs b/crates/mech/src/lib.rs
index a75b36ec..acf314aa 100644
--- a/crates/mech/src/lib.rs
+++ b/crates/mech/src/lib.rs
@@ -17,7 +17,7 @@ mod listeners;
 mod policy;
 mod tree;
 
-pub use batch::{batch_arguments_problem, is_batch_script};
+pub use batch::{batch_launch_problem, is_batch_script};
 pub use environment::{current_environment, encode_block, environment_block, merge_entries};
 pub use listeners::{listening_sockets, Listener, IPV4_ANY_ADDR, IPV4_LOOPBACK_ADDR};
 pub use policy::webview2_arguments_policy_present;