🤖 feat: use PowerShell + stdin for WSL to avoid escaping issues

- Pass bash script via stdin instead of command-line args to avoid
  PowerShell mangling special characters like %(refname:short)
- Add comprehensive PowerShell path detection (pwsh + Windows PowerShell)
- Add stdin field to SpawnConfig interface for callers to pipe to process
- Update all spawn sites to handle stdin content

This approach completely sidesteps command-line escaping issues because
the script content never touches PowerShell's argument parser.

Author: ibetitsmike

src/node/runtime/LocalBaseRuntime.ts

@@ -74,6 +74,7 @@ export abstract class LocalBaseRuntime implements Runtime {
       command: bashCommand,
       args: bashArgs,
       cwd: spawnCwd,
+      stdin: stdinContent,
     } = getPreferredSpawnConfig(command, cwd);
 
     // If niceness is specified on Unix/Linux, spawn nice directly to avoid escaping issues
@@ -103,6 +104,12 @@ export abstract class LocalBaseRuntime implements Runtime {
       windowsHide: true,
     });
 
+    // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
+    if (stdinContent) {
+      childProcess.stdin?.write(stdinContent);
+      childProcess.stdin?.end();
+    }
+
     // Wrap in DisposableProcess for automatic cleanup
     const disposable = new DisposableProcess(childProcess);
 
@@ -381,11 +388,13 @@ export abstract class LocalBaseRuntime implements Runtime {
         command: bashCommand,
         args: bashArgs,
         cwd: spawnCwd,
+        stdin: stdinContent,
       } = getPreferredSpawnConfig(`"${hookPath}"`, workspacePath);
 
       const proc = spawn(bashCommand, bashArgs, {
         cwd: spawnCwd,
-        stdio: ["ignore", "pipe", "pipe"],
+        // Use pipe for stdin if we need to send input (for WSL via PowerShell)
+        stdio: [stdinContent ? "pipe" : "ignore", "pipe", "pipe"],
         env: {
           ...process.env,
           ...getInitHookEnv(projectPath, runtimeType),
@@ -394,11 +403,17 @@ export abstract class LocalBaseRuntime implements Runtime {
         windowsHide: true,
       });
 
-      proc.stdout.on("data", (data: Buffer) => {
+      // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
+      if (stdinContent && proc.stdin) {
+        proc.stdin.write(stdinContent);
+        proc.stdin.end();
+      }
+
+      proc.stdout?.on("data", (data: Buffer) => {
         loggers.stdout.append(data.toString());
       });
 
-      proc.stderr.on("data", (data: Buffer) => {
+      proc.stderr?.on("data", (data: Buffer) => {
         loggers.stderr.append(data.toString());
       });
 

src/node/services/bashExecutionService.ts

@@ -128,6 +128,7 @@ export class BashExecutionService {
       command: bashCommand,
       args: bashArgs,
       cwd: spawnCwd,
+      stdin: stdinContent,
     } = getPreferredSpawnConfig(script, config.cwd);
 
     // Windows doesn't have nice command, so just spawn bash directly
@@ -141,7 +142,8 @@ export class BashExecutionService {
     const child = spawn(spawnCommand, spawnArgs, {
       cwd: spawnCwd,
       env: this.createBashEnvironment(config.secrets),
-      stdio: ["ignore", "pipe", "pipe"],
+      // Use pipe for stdin if we need to send input (for WSL via PowerShell)
+      stdio: [stdinContent ? "pipe" : "ignore", "pipe", "pipe"],
       // Spawn as detached process group leader to prevent zombie processes
       // When bash spawns background processes, detached:true allows killing
       // the entire group via process.kill(-pid)
@@ -150,6 +152,12 @@ export class BashExecutionService {
       windowsHide: true,
     });
 
+    // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
+    if (stdinContent && child.stdin) {
+      child.stdin.write(stdinContent);
+      child.stdin.end();
+    }
+
     log.debug(`BashExecutionService: Spawned process with PID ${child.pid ?? "unknown"}`);
 
     // Line-by-line streaming with incremental buffers

src/node/utils/disposableExec.ts

@@ -129,12 +129,19 @@ class DisposableExec implements Disposable {
 export function execAsync(command: string): DisposableExec {
   // Wrap command in bash -c for consistent cross-platform behavior
   // For WSL, this also translates Windows paths to /mnt/... format
-  const { command: bashCmd, args } = getPreferredSpawnConfig(command);
+  const { command: bashCmd, args, stdin } = getPreferredSpawnConfig(command);
   const child = spawn(bashCmd, args, {
-    stdio: ["ignore", "pipe", "pipe"],
+    // Use pipe for stdin if we need to send input (for WSL via PowerShell)
+    stdio: [stdin ? "pipe" : "ignore", "pipe", "pipe"],
     // Prevent console window from appearing on Windows
     windowsHide: true,
   });
+
+  // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
+  if (stdin && child.stdin) {
+    child.stdin.write(stdin);
+    child.stdin.end();
+  }
   const promise = new Promise<{ stdout: string; stderr: string }>((resolve, reject) => {
     let stdout = "";
     let stderr = "";

src/node/utils/main/bashPath.ts

@@ -54,6 +54,8 @@ export interface SpawnConfig {
   args: string[];
   /** Working directory (translated for WSL if needed) */
   cwd?: string;
+  /** Optional stdin to pipe to the process (used for WSL to avoid escaping issues) */
+  stdin?: string;
 }
 
 // ============================================================================
@@ -199,6 +201,83 @@ function findWslDistro(): string | null {
   return null;
 }
 
+/**
+ * Find PowerShell executable path
+ * We need the full path because Node.js spawn() may not have the same PATH as a user shell
+ */
+function findPowerShell(): string | null {
+  // PowerShell Core (pwsh) locations - preferred as it's cross-platform
+  const pwshPaths = [
+    // PowerShell Core default installation
+    "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
+    "C:\\Program Files\\PowerShell\\6\\pwsh.exe",
+    // User-local installation
+    path.join(process.env.LOCALAPPDATA ?? "", "Microsoft", "PowerShell", "pwsh.exe"),
+  ];
+
+  // Windows PowerShell (powershell.exe) - always present on Windows
+  const windowsPowerShellPaths = [
+    // 64-bit PowerShell
+    "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+    // 32-bit PowerShell (on 64-bit systems via SysWOW64)
+    "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
+  ];
+
+  // Try PowerShell Core first (better performance)
+  for (const psPath of pwshPaths) {
+    if (existsSync(psPath)) {
+      return psPath;
+    }
+  }
+
+  // Try to find pwsh in PATH
+  try {
+    const result = execSync("where pwsh", { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] });
+    const firstPath = result.split("\n")[0].trim();
+    if (firstPath && existsSync(firstPath)) {
+      return firstPath;
+    }
+  } catch {
+    // pwsh not in PATH
+  }
+
+  // Fall back to Windows PowerShell
+  for (const psPath of windowsPowerShellPaths) {
+    if (existsSync(psPath)) {
+      return psPath;
+    }
+  }
+
+  // Last resort: try to find powershell in PATH
+  try {
+    const result = execSync("where powershell", {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "ignore"],
+    });
+    const firstPath = result.split("\n")[0].trim();
+    if (firstPath && existsSync(firstPath)) {
+      return firstPath;
+    }
+  } catch {
+    // powershell not in PATH
+  }
+
+  return null;
+}
+
+// Cached PowerShell path (set during runtime detection)
+let cachedPowerShellPath: string | null | undefined = undefined;
+
+/**
+ * Get the PowerShell path, detecting it if not yet cached
+ */
+function getPowerShellPath(): string | null {
+  if (cachedPowerShellPath === undefined) {
+    cachedPowerShellPath = findPowerShell();
+  }
+  return cachedPowerShellPath;
+}
+
 /**
  * Detect all available bash runtimes on the current system
  * Results are cached for performance
@@ -280,14 +359,33 @@ export function getSpawnConfig(runtime: BashRuntime, script: string, cwd?: strin
     case "wsl": {
       // Translate Windows paths in the script for WSL
       const translatedScript = translateWindowsPathsInCommand(script);
-      // Translate cwd for WSL - this goes INSIDE the bash command, not to cmd.exe
+      // Translate cwd for WSL - this goes INSIDE the bash script
       const translatedCwd = cwd ? windowsToWslPath(cwd) : undefined;
 
       // Build the script that cd's to the right directory and runs the command
       const cdPrefix = translatedCwd ? `cd '${translatedCwd}' && ` : "";
       const fullScript = cdPrefix + translatedScript;
 
-      // Build the WSL command args
+      // Try to use PowerShell to hide WSL console window
+      // Pass the script via stdin to avoid PowerShell escaping issues with special chars
+      const psPath = getPowerShellPath();
+      if (psPath) {
+        // Build WSL command to read script from stdin
+        const wslCmd = runtime.distro ? `wsl -d ${runtime.distro} bash` : "wsl bash";
+
+        // PowerShell will receive the script via stdin and pipe it to WSL
+        // -NoProfile: faster startup, avoids profile execution policy issues
+        // -WindowStyle Hidden: hide console window
+        // -Command: execute the piped command
+        return {
+          command: psPath,
+          args: ["-NoProfile", "-WindowStyle", "Hidden", "-Command", `$input | ${wslCmd}`],
+          cwd: undefined, // cwd is embedded in the script
+          stdin: fullScript,
+        };
+      }
+
+      // Fallback: direct WSL invocation (console window may flash)
       const wslArgs: string[] = [];
       if (runtime.distro) {
         wslArgs.push("-d", runtime.distro);