The session_start env block previously named the OS but not the shell.
When the model reads 'Operating System: Windows' it defaults to POSIX
syntax by habit and emits '&&', 'grep', 'head', '2>/dev/null', 'ls -la',
'$(pwd)' — none of which work under Windows PowerShell 5.1 or cmd.exe.
The shell tool description already carries a shell-specific hint
(shellSyntaxHint), but it sits far from the user turn and is drowned
out by the agent's own system prompt; the env block sits at the top
of every turn and is cached, so that is where the disambiguation
belongs.
Resolve the shell via the shared shellpath.DetectShell helper and print
its base name plus the resolved path. Long-form dialect rules stay in
the shell tool description (shellSyntaxHint) so this block stays terse
and doesn't diverge from them.
The base-name derivation lives in a new shellpath.ShellBaseName helper
so the same logic isn't copied into hooks/builtins.
No behaviour change on darwin/linux where the shell defaults to $SHELL
or /bin/sh; the extra 'Shell:' line lands cleanly in the existing
tab-indented env block.
Passes exit message via DOCKER_AGENT_SHELL_EXIT_MSG env var instead of
interpolating into the command line (prevents injection). Uses POSIX printf,
cmd.exe delayed expansion on Windows, dedupes PowerShell lookup. Validates
worktree exists before exec'ing in board TUI.
Assisted-By: Claude
Introduce pkg/shellpath to centralize safe shell binary resolution:
- WindowsCmdExe() resolves cmd.exe via ComSpec or %SystemRoot%\System32
instead of bare PATH lookup
- DetectShell()/DetectWindowsShell() use exec.LookPath (absolute paths)
for PowerShell, falling back to WindowsCmdExe()
Replace vulnerable bare cmd.exe resolution in three critical locations:
- pkg/tools/builtin/shell.go (detectShell)
- pkg/hooks/executor.go (initShell)
- pkg/tui/handlers.go (startShell)
Fix TOCTOU race in credential providers:
- lookupBinary() now returns the resolved absolute path
- KeychainProvider and PassProvider store and reuse the resolved path
instead of re-resolving bare binary names at invocation time
Assisted-By: docker-agent
Trung Nguyen
David Gageot