fix: quote PowerShell paths containing special characters

src/runtime/utils.ts

@@ -42,13 +42,21 @@ type QuoteChar = `"` | `'` | "`";
 
 const isQuoted = (value: string | undefined, quoteChar: QuoteChar): boolean => (value?.startsWith(quoteChar) && value?.endsWith(quoteChar)) ?? false;
 
-const quoteString = (value: string, quoteChar: QuoteChar): string => {
+const isPowerShell = (shell: Shell): boolean => shell == Shell.Pwsh || shell == Shell.Powershell;
+
+// characters that PowerShell interprets in argument mode; '@' and '#' only matter at the start of an argument
+const pwshSpecialCharacters = /[\s'"`$&|;,(){}<>]|^[@#]/;
+
+const quoteString = (value: string, quoteChar: QuoteChar, shell: Shell): string => {
   if (isQuoted(value, quoteChar)) return value;
+  // PowerShell single-quoted strings are literal; an embedded single quote is written as two single quotes
+  if (isPowerShell(shell)) return `'${value.replaceAll("'", "''")}'`;
   const escapedValue = value.replaceAll(`\\${quoteChar}`, quoteChar).replaceAll(quoteChar, `\\${quoteChar}`);
   return `${quoteChar}${escapedValue}${quoteChar}`;
 };
 
-const needsQuoted = (value: string, quoteChar: QuoteChar): boolean => isQuoted(value, quoteChar) || value.includes(" ");
+const needsQuoted = (value: string, quoteChar: QuoteChar, shell: Shell): boolean =>
+  isQuoted(value, quoteChar) || (isPowerShell(shell) ? pwshSpecialCharacters.test(value) : value.includes(" "));
 
 const getShellQuoteChar = (shell: Shell): QuoteChar => {
   switch (shell) {
@@ -85,7 +93,7 @@ export const getShellWhitespaceEscapeChar = (shell: Shell): string => {
 };
 
 export const escapePath = (value: string | undefined, shell: Shell): string | undefined =>
-  value != null && needsQuoted(value, getShellQuoteChar(shell)) ? quoteString(value, getShellQuoteChar(shell)) : value;
+  value != null && needsQuoted(value, getShellQuoteChar(shell), shell) ? quoteString(value, getShellQuoteChar(shell), shell) : value;
 
 export const buildExecuteShellCommand =
   (timeout: number, signal?: AbortSignal): Fig.ExecuteCommandFunction =>

src/tests/runtime/utils.test.ts

@@ -0,0 +1,45 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { escapePath } from "../../runtime/utils.js";
+import { Shell } from "../../utils/shell.js";
+
+describe("escapePath", () => {
+  test("bash quotes paths containing spaces", () => {
+    expect(escapePath("My Docs/", Shell.Bash)).toBe('"My Docs/"');
+  });
+
+  test("bash leaves plain paths unchanged", () => {
+    expect(escapePath("src/", Shell.Bash)).toBe("src/");
+  });
+
+  describe.each([Shell.Pwsh, Shell.Powershell])("%s", (shell) => {
+    test("leaves plain paths unchanged", () => {
+      expect(escapePath("src/", shell)).toBe("src/");
+      expect(escapePath("a@b/", shell)).toBe("a@b/");
+    });
+
+    test.each([
+      ["My Docs/", "'My Docs/'"],
+      ["a$b/", "'a$b/'"],
+      ["a&b/", "'a&b/'"],
+      ["a`b/", "'a`b/'"],
+      ["a;b/", "'a;b/'"],
+      ["a,b/", "'a,b/'"],
+      ["a(b)/", "'a(b)/'"],
+      ["@a/", "'@a/'"],
+      ["#a/", "'#a/'"],
+    ])("single-quotes %s", (value, expected) => {
+      expect(escapePath(value, shell)).toBe(expected);
+    });
+
+    test("doubles embedded single quotes", () => {
+      expect(escapePath("it's/", shell)).toBe("'it''s/'");
+      expect(escapePath("it's dir/", shell)).toBe("'it''s dir/'");
+    });
+
+    test("keeps already quoted paths", () => {
+      expect(escapePath("'My Docs/'", shell)).toBe("'My Docs/'");
+    });
+  });
+});