fix(agent-hooks): stop the Windows hook launcher spelling the AV-denied flag pair (STA-5237)

mirror of https://github.com/stablyai/orca.git synced 2026-10-24 08:03:58 +00:00

`-WindowStyle Hidden` + `-EncodedCommand` is denied at CreateProcess by
Kaspersky on Windows 11, whatever the payload decodes to. Bash reports it as
`Permission denied` and every managed hook event fails, so agent status never
arrives; the parent shell also briefly cannot spawn anything afterwards, so a
denied hook can take the user's next command down with it.

Measured on the reporting host (#16003), with a harmless `exit 0` payload:

  -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand  126
  -NoProfile -WindowStyle Hidden -EncodedCommand                          126
  -WindowStyle Hidden -EncodedCommand                                     126
  -NoProfile -EncodedCommand                                              0 (5/5)

#16576 removed `-ExecutionPolicy Bypass`, which is the one flag of the three
NOT in the signature, so hooks kept failing after that fix. The pair that has
to stop being spelled is `-WindowStyle Hidden` + `-EncodedCommand`.

Because the change is to the shared switch constant, it covers every site that
spells the denied pair in one edit: Claude via `wrapWindowsPowerShellEncodedCommand`,
gemini/cursor/droid/command-code/copilot via `wrapWindowsHookCommand`, the
`runtime-home-hook-command` unsafe-HOME fallback, and the spaced-path fallback
for codex/grok/devin/antigravity. Only a flag is removed, so parser and payload
compatibility is unchanged for every executor: the string is still a PowerShell
command line, still one self-contained token, still base64-shielded.

The tradeoff, recorded rather than hidden: `-WindowStyle Hidden` was the shipped
fix for #14815 (+#14828, #15117, #15447, #15767), and this removes it. Its
suppression was never measured — #14825 confirmed it visually, #16576's author
stated it "remains unverified on a real box", and #15506's author argued it
cannot help a `.cmd` child with no console to inherit. The console is allocated
by the parent chain, not by this command line. A live window measurement is
still outstanding and is called out in the PR.

Also adds `windows-hook-payload-delivery.test.ts` to the PR CI Windows leg,
which had never run it.

This commit is contained in:

Brennan Benson

2026-08-27 10:43:53 -07:00

parent 642607bfa7

commit c8271aa8e8

11 changed files with 60 additions and 53 deletions

									
										.github/workflows/pr.yml
									
		+1
		
												View File
												
				@@ -703,6 +703,7 @@ jobs:

				          src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts

				          src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts

				          src/shared/child-process/windows-command-line.win32.test.ts

				          src/main/agent-hooks/windows-hook-payload-delivery.test.ts

				          src/main/windows/windows-pty-job.win32.test.ts

				          src/main/windows/windows-host-job.win32.test.ts

				          src/main/wsl/wsl-runner.test.ts