🤖 fix: use base64 encoding instead of stdin for PowerShell WSL wrapper

Stdin piping to PowerShell didn't work reliably ($input and [Console]::In
both failed). Instead, use base64 encoding to embed the script safely in
the PowerShell command line:

1. Base64 encode the bash script (completely avoids escaping issues)
2. PowerShell decodes it with [System.Text.Encoding]::UTF8.GetString()
3. Echo the decoded script and pipe to WSL bash

This approach is robust because base64 strings only contain [A-Za-z0-9+/=]
which have no special meaning in PowerShell.

Also removes the now-unused stdin field from SpawnConfig.

Author: ibetitsmike

src/node/runtime/LocalBaseRuntime.ts

@@ -74,7 +74,6 @@ export abstract class LocalBaseRuntime implements Runtime {
       command: bashCommand,
       args: bashArgs,
       cwd: spawnCwd,
-      stdin: stdinContent,
     } = getPreferredSpawnConfig(command, cwd);
 
     // If niceness is specified on Unix/Linux, spawn nice directly to avoid escaping issues
@@ -104,12 +103,6 @@ export abstract class LocalBaseRuntime implements Runtime {
       windowsHide: true,
     });
 
-    // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
-    if (stdinContent) {
-      childProcess.stdin?.write(stdinContent);
-      childProcess.stdin?.end();
-    }
-
     // Wrap in DisposableProcess for automatic cleanup
     const disposable = new DisposableProcess(childProcess);
 
@@ -388,13 +381,11 @@ export abstract class LocalBaseRuntime implements Runtime {
         command: bashCommand,
         args: bashArgs,
         cwd: spawnCwd,
-        stdin: stdinContent,
       } = getPreferredSpawnConfig(`"${hookPath}"`, workspacePath);
 
       const proc = spawn(bashCommand, bashArgs, {
         cwd: spawnCwd,
-        // Use pipe for stdin if we need to send input (for WSL via PowerShell)
-        stdio: [stdinContent ? "pipe" : "ignore", "pipe", "pipe"],
+        stdio: ["ignore", "pipe", "pipe"],
         env: {
           ...process.env,
           ...getInitHookEnv(projectPath, runtimeType),
@@ -403,12 +394,6 @@ export abstract class LocalBaseRuntime implements Runtime {
         windowsHide: true,
       });
 
-      // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
-      if (stdinContent && proc.stdin) {
-        proc.stdin.write(stdinContent);
-        proc.stdin.end();
-      }
-
       proc.stdout?.on("data", (data: Buffer) => {
         loggers.stdout.append(data.toString());
       });

src/node/services/bashExecutionService.ts

@@ -128,7 +128,6 @@ export class BashExecutionService {
       command: bashCommand,
       args: bashArgs,
       cwd: spawnCwd,
-      stdin: stdinContent,
     } = getPreferredSpawnConfig(script, config.cwd);
 
     // Windows doesn't have nice command, so just spawn bash directly
@@ -142,8 +141,7 @@ export class BashExecutionService {
     const child = spawn(spawnCommand, spawnArgs, {
       cwd: spawnCwd,
       env: this.createBashEnvironment(config.secrets),
-      // Use pipe for stdin if we need to send input (for WSL via PowerShell)
-      stdio: [stdinContent ? "pipe" : "ignore", "pipe", "pipe"],
+      stdio: ["ignore", "pipe", "pipe"],
       // Spawn as detached process group leader to prevent zombie processes
       // When bash spawns background processes, detached:true allows killing
       // the entire group via process.kill(-pid)
@@ -152,12 +150,6 @@ export class BashExecutionService {
       windowsHide: true,
     });
 
-    // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
-    if (stdinContent && child.stdin) {
-      child.stdin.write(stdinContent);
-      child.stdin.end();
-    }
-
     log.debug(`BashExecutionService: Spawned process with PID ${child.pid ?? "unknown"}`);
 
     // Line-by-line streaming with incremental buffers

src/node/utils/disposableExec.ts

@@ -129,19 +129,12 @@ class DisposableExec implements Disposable {
 export function execAsync(command: string): DisposableExec {
   // Wrap command in bash -c for consistent cross-platform behavior
   // For WSL, this also translates Windows paths to /mnt/... format
-  const { command: bashCmd, args, stdin } = getPreferredSpawnConfig(command);
+  const { command: bashCmd, args } = getPreferredSpawnConfig(command);
   const child = spawn(bashCmd, args, {
-    // Use pipe for stdin if we need to send input (for WSL via PowerShell)
-    stdio: [stdin ? "pipe" : "ignore", "pipe", "pipe"],
+    stdio: ["ignore", "pipe", "pipe"],
     // Prevent console window from appearing on Windows
     windowsHide: true,
   });
-
-  // Write stdin content if provided (used for WSL via PowerShell to avoid escaping issues)
-  if (stdin && child.stdin) {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
   const promise = new Promise<{ stdout: string; stderr: string }>((resolve, reject) => {
     let stdout = "";
     let stderr = "";

src/node/utils/main/bashPath.ts

@@ -54,8 +54,6 @@ export interface SpawnConfig {
   args: string[];
   /** Working directory (translated for WSL if needed) */
   cwd?: string;
-  /** Optional stdin to pipe to the process (used for WSL to avoid escaping issues) */
-  stdin?: string;
 }
 
 // ============================================================================
@@ -388,29 +386,24 @@ export function getSpawnConfig(runtime: BashRuntime, script: string, cwd?: strin
       const fullScript = cdPrefix + translatedScript;
 
       // Try to use PowerShell to hide WSL console window
-      // Pass the script via stdin to avoid PowerShell escaping issues with special chars
+      // Use base64 encoding to completely avoid escaping issues with special chars
       const psPath = getPowerShellPath();
       if (psPath) {
-        // Build WSL command to read script from stdin
-        const wslCmd = runtime.distro ? `wsl -d ${runtime.distro} bash` : "wsl bash";
-
-        // PowerShell will receive the script via stdin and pipe it to WSL
-        // -NoProfile: faster startup, avoids profile execution policy issues
-        // -WindowStyle Hidden: hide console window
-        // -Command: execute the piped command
-        // Use [Console]::In.ReadToEnd() instead of $input because $input doesn't work
-        // reliably with -Command (it's meant for pipeline input in functions/filters)
+        // Base64 encode the script to avoid any PowerShell parsing issues
+        // PowerShell will decode it and pipe to WSL bash
+        const base64Script = Buffer.from(fullScript, "utf8").toString("base64");
+
+        // Build the PowerShell command that:
+        // 1. Decodes the base64 script
+        // 2. Pipes it to WSL bash via echo
+        const wslArgs = runtime.distro ? `-d ${runtime.distro}` : "";
+        const psCommand = `$s=[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${base64Script}'));` +
+          `echo $s | wsl ${wslArgs} bash`.trim();
+
         return {
           command: psPath,
-          args: [
-            "-NoProfile",
-            "-WindowStyle",
-            "Hidden",
-            "-Command",
-            `[Console]::In.ReadToEnd() | ${wslCmd}`,
-          ],
+          args: ["-NoProfile", "-WindowStyle", "Hidden", "-Command", psCommand],
           cwd: undefined, // cwd is embedded in the script
-          stdin: fullScript,
         };
       }