[Installer] Offer to close blocking processes and retry purge on upgrade (#7664)

* [Installer] Offer to close blocking processes and retry purge on upgrade

* [Installer] Retry the purge after closing only our own applications

The first version of this fix closed every Restart Manager holder through
RmShutdown, forcing what refused to close. RmShutdown also stops services, and
the only API that brings them back is RmRestart, which would restart Cockatrice
itself into the files that are about to be replaced; the forced pass also
contradicts the running-instance guard, which never force-closes Cockatrice
because it may be holding an unsaved deck. The guard ran first anyway, so for
the case the fix exists for - a Cockatrice restarted during the update - the
probe never got to run: the guard waited 60 s and aborted.

Keep the prompt and the retry, but ask only Cockatrice, Oracle and Servatrice to
close, with WM_CLOSE and nothing else, and leave every other holder named by the
probe to the user. Repeat the prompt while the user keeps saying Yes, refresh
the names after a failed retry, and keep the /R abort message pointing at the
downloaded installer.

Also clear the read-only attribute before every purge attempt. Delete and RMDir
leave such a file in place, so the retry could never make progress, and the
diagnostics branch that named the cause had no action behind it.

The holder probe goes back to being diagnostic-only, so its Restart Manager
code and the --close argument are dropped.

* [Installer] Make an accepted close of the running client actually land

WM_CLOSE is a request, and Cockatrice answers it: while a card database
update is running, a game is open or a deck is unsaved it puts up its own
"are you sure?" confirmation. That dialog opened behind the installer's
prompt, so the user saw nothing happen; the next Yes was posted to a main
window the app's own modal dialog had disabled, so it was ignored as well,
and the identical yes/no prompt came back with no hint of why.

- Activate the matching window before posting WM_CLOSE, so the app's own
  confirmation is in front where it can be answered.
- Wait up to 30 s for cockatrice.exe to exit instead of purging after a
  fixed 2 s, so the purge measures the app gone rather than its dialog.
- On the second and later rounds ask with Retry/Cancel and say what is
  needed, instead of repeating the same offer that just did nothing.
- Stop promising Oracle and Servatrice: they are console applications, so
  CloseMainWindow() has nothing to send WM_CLOSE to. They are not
  force-stopped either - Oracle writes the card database in place.

* [Installer] Close the client from the holder probe, not PowerShell

Accepting the offer to close did nothing on a real machine: the instance stayed
up, never came forward, and the same prompt came back.

The prompt names its holders from the Restart Manager probe, but the close itself
went through powershell.exe: Get-Process -Name, a strict "path starts with
$INSTDIR" filter, then Process.CloseMainWindow() and a WScript.Shell AppActivate.
Every step of that is silent. A process whose path cannot be read is filtered
out, a process .NET finds no main window for makes CloseMainWindow() return
false without posting anything, and AppActivate is refused for a background
caller - so an attempted close, a missed close and a close request the client
ignored all looked the same in the log: nothing.

Ask the probe instead. installer-holder-probe --close-holders closes exactly the
processes Restart Manager just named as holding a file of the version being
replaced, so no executable path has to be guessed and a third party application
that merely shares the image name is never in the set. Per instance it restores
and brings the top-level window forward (AttachThreadInput, so the client's own
"really quit?" confirmation is on screen rather than behind the installer), posts
WM_CLOSE to the main window, and waits up to 30 s for the process to exit. Its
report names every holder with what happened to it, including the ones left to
the user, and goes into the installer log as one line.

That also removes the separate PowerShell polling loop that used to wait for the
close: the probe holds a handle on the process it asked, so the purge that
follows measures a settled directory.

Oracle and Servatrice are still never closed, and nothing is force-stopped.

---------

Co-authored-by: sentry[bot] <39604003+sentry[bot]@users.noreply.github.com>
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

tools/installer-holder-probe/main.cpp

@@ -1,3 +1,4 @@
+#include "close_holders.h"
 #include "holder_line.h"
 #include "restart_manager_holders.h"
 
@@ -12,8 +13,16 @@ namespace
 /// trailing backslash then never has to survive NSIS quoting or a command line.
 constexpr wchar_t INSTALL_DIR_VARIABLE[] = L"COCKATRICE_GUARD_DIR";
 
+/// How long the close mode waits for the instance it asked to exit before it reports the
+/// process as still running. The installer measures the purge right after this call, so
+/// the wait belongs here: it is the only place that holds a handle on the process whose
+/// exit it is waiting for.
+constexpr unsigned long CLOSE_WAIT_MILLISECONDS = 30000;
+
 /// Exit codes the installer reads. "Something was found" is deliberately not 0, so an
 /// answer of "nothing holds the files" stays distinguishable from a probe that failed.
+/// In the close mode 1 means a close was actually sent and 0 that every holder was left
+/// to the user, which is what the report line next to the code spells out.
 enum ExitCode
 {
     EXIT_NO_HOLDERS = 0,
@@ -22,6 +31,20 @@ enum ExitCode
     EXIT_PROBE_FAILED = 3,
 };
 
+/// The probe has two modes, selected by the first argument:
+///
+///   (none)           name what holds the install directory, one line, for the abort
+///                     dialog and the log
+///   --close-holders  bring the running Cockatrice forward, ask it to close, and wait for
+///                     it to exit, for the offer to close after a failed purge
+///
+/// Both answer from the same Restart Manager query, so the close can only ever reach a
+/// process that is holding a file of the version being replaced.
+bool closeModeRequested(int argumentCount, char **arguments)
+{
+    return argumentCount > 1 && std::string(arguments[1]) == "--close-holders";
+}
+
 /// Writes one line to the pipe nsExec reads. Narrowed to ASCII on purpose: the bytes
 /// come back to the installer as an ANSI string, so a non-ASCII process name would be
 /// mojibake in the log; a '?' at least stays honest. Control characters are dropped
@@ -54,7 +77,7 @@ std::wstring installDirFromEnvironment()
 }
 } // namespace
 
-int main()
+int main(int argumentCount, char **arguments)
 {
     const std::wstring installDir = installDirFromEnvironment();
     if (installDir.empty()) {
@@ -68,11 +91,23 @@ int main()
         writeLine(L"the Restart Manager lookup failed with win32 error " + std::to_wstring(error));
         return EXIT_PROBE_FAILED;
     }
+
+    const bool closeMode = closeModeRequested(argumentCount, arguments);
     if (holders.empty()) {
-        // No output: the installer words the "nothing is holding them" case, and it
-        // owns the message either way.
+        // No output in the naming mode: the installer words the "nothing is holding them"
+        // case, and it owns the message either way. The close mode says it itself, because
+        // its line is logged verbatim next to what it was asked to do.
+        if (closeMode) {
+            writeLine(L"nothing is holding the files");
+        }
         return EXIT_NO_HOLDERS;
     }
-    writeLine(formatHolders(holders));
-    return EXIT_HOLDERS_FOUND;
+    if (!closeMode) {
+        writeLine(formatHolders(holders));
+        return EXIT_HOLDERS_FOUND;
+    }
+
+    const CloseHoldersResult result = closeCockatriceHolders(holders, CLOSE_WAIT_MILLISECONDS);
+    writeLine(result.report);
+    return result.askedToClose > 0 ? EXIT_HOLDERS_FOUND : EXIT_NO_HOLDERS;
 }