fix(windows): isolate ACP environment probes from stdin

tests/tools/test_find_shell.py

@@ -162,6 +162,23 @@ def fake_run(argv, **kwargs):
 
         assert local_mod._bash_starts(r"C:\Git\bin\bash.exe") is True
         assert calls[0][0][-1] == "/usr/bin/true; /usr/bin/cat --version >/dev/null"
+        assert calls[0][1]["stdin"] is subprocess.DEVNULL
+
+    def test_mandatory_aslr_probe_detaches_stdin(self, monkeypatch):
+        import tools.environments.local as local_mod
+
+        monkeypatch.setattr(local_mod, "_mandatory_aslr_enabled_cache", None)
+        calls = []
+
+        def fake_run(argv, **kwargs):
+            calls.append((argv, kwargs))
+            return subprocess.CompletedProcess(argv, 0, stdout="ON\n", stderr="")
+
+        monkeypatch.setattr(local_mod.subprocess, "run", fake_run)
+        monkeypatch.setattr(local_mod.shutil, "which", lambda _name: "powershell.exe")
+
+        assert local_mod._mandatory_aslr_enabled() is True
+        assert calls[0][1]["stdin"] is subprocess.DEVNULL
 
     def test_aslr_failure_surfaces_targeted_windows_command(
         self, tmp_path, monkeypatch

tools/environments/local.py

@@ -740,6 +740,7 @@ def _mandatory_aslr_enabled() -> "bool | None":
                 "-Command",
                 "(Get-ProcessMitigation -System).Aslr.ForceRelocateImages.ToString()",
             ],
+            stdin=subprocess.DEVNULL,
             capture_output=True,
             text=True,
             timeout=10,
@@ -806,6 +807,7 @@ def _bash_starts(bash: str) -> bool:
     try:
         result = subprocess.run(
             [bash, "--noprofile", "--norc", "-c", _BASH_EXTERNAL_PROGRAM_PROBE],
+            stdin=subprocess.DEVNULL,
             capture_output=True,
             text=True,
             timeout=15,