From 0c674d670fd233504cd5f2e73beb4caab1e1afdb Mon Sep 17 00:00:00 2001 From: Joseph Yaksich Date: Wed, 5 Aug 2026 04:41:36 +0000 Subject: [PATCH] fix(phase4): preserve Windows WSL command scripts over stdin Windows PowerShell 5 re-quotes native command arguments before invoking wsl.exe. That mangled the otherwise-literal service/version assertion into `active) = active` inside bash. Pass all in-distribution command scripts over stdin to `bash -s` instead of as a `bash -lc` argument. The exact transport was proven under the real limited helm-ph4 runner account on VM 115 with an isolated WSL distribution. Keep a structural regression test that requires stdin transport and rejects the argument form. Co-Authored-By: Claude --- ops/platform-acceptance/windows.ps1 | 6 +++++- test/phase4-platform-acceptance.mjs | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/ops/platform-acceptance/windows.ps1 b/ops/platform-acceptance/windows.ps1 index aa0836f..17ef2d8 100644 --- a/ops/platform-acceptance/windows.ps1 +++ b/ops/platform-acceptance/windows.ps1 @@ -29,7 +29,11 @@ function Get-Distros { return @($raw -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ }) } function Invoke-Distro([string] $Command) { - & $Wsl -d $Distro -u root --exec /bin/bash -lc $Command | Out-Host + # PowerShell 5 re-quotes native command arguments before invoking wsl.exe. + # That mangles bash substitutions and nested quotes even when the + # PowerShell string itself is literal. Send the script over stdin instead; + # this preserves the exact bytes and was proven under the real runner user. + $Command | & $Wsl -d $Distro -u root --exec /bin/bash -s | Out-Host if ($LASTEXITCODE -ne 0) { Refuse "in-distribution command failed: $Command" } } function Assert-DistroVersion([string] $ExpectedVersion) { diff --git a/test/phase4-platform-acceptance.mjs b/test/phase4-platform-acceptance.mjs index ee1c0bb..90e16af 100644 --- a/test/phase4-platform-acceptance.mjs +++ b/test/phase4-platform-acceptance.mjs @@ -212,6 +212,8 @@ test("Windows code publishes no artifact/signing claim and requires honest reboo assert.match(windows, /apply-linux-release\.sh/); assert.match(windows, /function Assert-DistroVersion/); assert.equal((windows.match(/Assert-DistroVersion \$(?:Version|PreviousVersion)/g) || []).length, 4); + assert.match(windows, /\$Command \| & \$Wsl -d \$Distro -u root --exec \/bin\/bash -s/); + assert.doesNotMatch(windows, /\/bin\/bash -lc \$Command/); assert.doesNotMatch(windows, /Invoke-Distro "test .*systemctl/); assert.match(windows, /LocalRootfs/); assert.match(read("site/public/install.ps1"), /LocalRootfsSha256/);