fix(terminal): route desktop (Windows/WSL) SSH commands via stdin

tests/tools/test_ssh_environment.py

@@ -67,6 +67,75 @@ def test_user_host_suffix(self):
         assert env._build_ssh_command()[-1] == "u@h"
 
 
+class TestRunBashQuoting:
+    """Regression coverage for the desktop (Windows) quoting bug.
+
+    ssh joins trailing argv elements with spaces and sends the joined string
+    for the remote side to re-parse. A POSIX login shell strips
+    shlex.quote()'s quotes correctly, so `bash -c <shlex.quote(cmd)>` keeps
+    cmd_string as one argument. A Windows OpenSSH host's re-parse does not
+    preserve that quoting, so any command-line-embedded script (not just
+    trivial one-liners) arrives mangled — so Windows hosts instead send the
+    script over the SSH stdin channel (`bash -s`), sidestepping the remote
+    command-line re-parse entirely.
+    """
+
+    @pytest.fixture(autouse=True)
+    def _mock_connection(self, monkeypatch):
+        monkeypatch.setattr("tools.environments.ssh.subprocess.run",
+                            lambda *a, **k: subprocess.CompletedProcess([], 0))
+        monkeypatch.setattr("tools.environments.base.time.sleep", lambda _: None)
+
+    def _captured_call(self, env, cmd_string, monkeypatch, **kwargs):
+        captured = {}
+
+        def fake_popen_bash(cmd, stdin_data):
+            captured["cmd"] = cmd
+            captured["stdin_data"] = stdin_data
+            return MagicMock()
+
+        monkeypatch.setattr("tools.environments.ssh._popen_bash", fake_popen_bash)
+        env._run_bash(cmd_string, **kwargs)
+        return captured
+
+    def test_posix_host_quotes_compound_command(self, monkeypatch):
+        env = SSHEnvironment(host="h", user="u")  # default remote_shell="posix"
+        captured = self._captured_call(env, "hostname && whoami", monkeypatch)
+        cmd = captured["cmd"]
+        assert cmd[cmd.index("-c") + 1] == "'hostname && whoami'"
+
+    def test_posix_host_quotes_simple_command_when_needed(self, monkeypatch):
+        # shlex.quote leaves safe single words unquoted either way, so use
+        # a command with a space to actually exercise the quoting branch.
+        env = SSHEnvironment(host="h", user="u")
+        captured = self._captured_call(env, "echo hello world", monkeypatch, login=True)
+        cmd = captured["cmd"]
+        assert cmd[cmd.index("-c") + 1] == "'echo hello world'"
+
+    def test_windows_host_sends_script_via_stdin_not_command_line(self, monkeypatch):
+        env = SSHEnvironment(host="h", user="u", remote_shell="windows")
+        cmd_string = "echo hello && echo world"
+        captured = self._captured_call(env, cmd_string, monkeypatch)
+        cmd = captured["cmd"]
+        # No -c, no embedded script text anywhere in the argv — only "-s".
+        assert "-c" not in cmd
+        assert "-s" in cmd
+        assert cmd_string not in cmd
+        assert captured["stdin_data"].startswith(cmd_string + "\n")
+
+    def test_windows_host_login_flag_with_stdin_script(self, monkeypatch):
+        env = SSHEnvironment(host="h", user="u", remote_shell="windows")
+        captured = self._captured_call(env, "whoami", monkeypatch, login=True)
+        cmd = captured["cmd"]
+        bash_idx = cmd.index("bash")
+        assert cmd[bash_idx:bash_idx + 3] == ["bash", "-l", "-s"]
+
+    def test_windows_host_appends_real_stdin_after_script(self, monkeypatch):
+        env = SSHEnvironment(host="h", user="u", remote_shell="windows")
+        captured = self._captured_call(env, "cat", monkeypatch, stdin_data="payload\n")
+        assert captured["stdin_data"] == "cat\npayload\n"
+
+
 class TestControlSocketPath:
     """Regression tests for issue #11840.
 

tools/environments/ssh.py

@@ -43,12 +43,20 @@ class SSHEnvironment(BaseEnvironment):
     """
 
     def __init__(self, host: str, user: str, cwd: str = "~",
-                 timeout: int = 60, port: int = 22, key_path: str = ""):
+                 timeout: int = 60, port: int = 22, key_path: str = "",
+                 remote_shell: str = "posix"):
         super().__init__(cwd=cwd, timeout=timeout)
         self.host = host
         self.user = user
         self.port = port
         self.key_path = key_path
+        # "posix": ssh's remote-side re-parse of the joined command line goes
+        # through the user's POSIX login shell, which strips shlex.quote()'s
+        # single-quotes correctly. "windows": the remote re-parse doesn't
+        # preserve POSIX quoting, so shlex.quote() arrives mangled — pass the
+        # command unquoted instead. Verified empirically against both a POSIX
+        # host and a Windows OpenSSH host on 2026-07-10.
+        self.remote_shell = remote_shell
 
         self.control_dir = Path(tempfile.gettempdir()) / "hermes-ssh"
         self.control_dir.mkdir(parents=True, exist_ok=True)
@@ -343,8 +351,29 @@ def _before_execute(self) -> None:
     def _run_bash(self, cmd_string: str, *, login: bool = False,
                   timeout: int = 120,
                   stdin_data: str | None = None) -> subprocess.Popen:
-        """Spawn an SSH process that runs bash on the remote host."""
+        """Spawn an SSH process that runs bash on the remote host.
+
+        ssh joins the trailing argv elements with spaces and sends that as
+        one string for the remote side to re-parse. A POSIX login shell
+        strips shlex.quote()'s single-quotes correctly, so quoting via
+        `bash -c <shlex.quote(cmd_string)>` keeps cmd_string as one argument.
+
+        A Windows OpenSSH host's re-parse does not preserve that quoting the
+        same way — any command-line-embedded script (quotes, newlines,
+        wrapper markers) arrives mangled, not just simple one-liners. So for
+        `self.remote_shell == "windows"`, cmd_string is sent over the SSH
+        stdin channel instead of the command line (`bash -s`, script read
+        from stdin) — this sidesteps the remote-side re-parse entirely.
+        Real stdin_data (if any) is appended after the script, matching how
+        `some_script | bash` lets the script's own commands keep reading
+        stdin once the script text is consumed.
+        """
         cmd = self._build_ssh_command()
+        if self.remote_shell == "windows":
+            cmd.extend(["bash", "-l", "-s"] if login else ["bash", "-s"])
+            combined_stdin = cmd_string + "\n" + (stdin_data or "")
+            return _popen_bash(cmd, combined_stdin)
+
         if login:
             cmd.extend(["bash", "-l", "-c", shlex.quote(cmd_string)])
         else:

tools/terminal_tool.py

@@ -62,7 +62,10 @@
     "macbook-personal": {"host": "192.168.1.2", "user": "davevoyles"},
     "macbook-dock": {"host": "192.168.1.39", "user": "davevoyles"},
     "macbook": {"host": "Daves-MacBook-Pro-2.local", "user": "davevoyles"},
-    "desktop": {"host": "192.168.1.24", "user": "DaveV"},
+    # remote_shell="windows": ssh's remote-side re-parse of the joined command
+    # line strips single-quotes differently than a POSIX login shell does, so
+    # shlex.quote()'d args arrive mangled. See SSHEnvironment._run_bash.
+    "desktop": {"host": "192.168.1.24", "user": "DaveV", "remote_shell": "windows"},
 }
 
 
@@ -1544,6 +1547,7 @@ def _create_environment(env_type: str, image: str, cwd: str, timeout: int,
             user=ssh_config["user"],
             port=ssh_config.get("port", 22),
             key_path=ssh_config.get("key", ""),
+            remote_shell=ssh_config.get("remote_shell", "posix"),
             cwd=cwd,
             timeout=timeout,
         )
@@ -2244,6 +2248,7 @@ def terminal_tool(
                                     "port": resolved_host.get("port", 22),
                                     "key": resolved_host.get("key", ""),
                                     "persistent": resolved_host.get("persistent", False),
+                                    "remote_shell": resolved_host.get("remote_shell", "posix"),
                                 }
                             else:
                                 ssh_config = {