[gargarnav]

Fixes: suggests an improvement (hardening of quotePowerShell)

Why

quotePowerShell() wraps a value in ASCII single quotes and doubles only the ASCII apostrophe. PowerShell also treats U+2018, U+2019, U+201A and U+201B as single-quote characters, so a value containing one of them closes the string early and the remainder is parsed as PowerShell code.

With usePwsh() (or $.quote = quotePowerShell) and untrusted input:

import {$, usePwsh} from 'zx'
usePwsh()
const v = 'x’; Write-Output INJECTED; ‘y'
await $`Write-Output ${v}`
// before: prints x / INJECTED / y (the second statement ran)
// after:  prints the value literally

I confirmed the before behavior on PowerShell 7.6.7 (macOS) for U+2018 and U+2019 by running the emitted command shape (<cmd>; exit $LastExitCode) directly. U+201A and U+201B are listed as single quotes in PowerShell's quoting rules and are covered by the fix.

Change

src/util.ts: arg.replace(/['‘’‚‛]/g, (c) => c + c), plus a test for the four characters and the regenerated build/util.cjs.

Checks

• Setup Node.js current (v25.6.1 locally)
• Build: ran npm run build; only build/util.cjs changed meaningfully (other generated noise reverted)
• Tests: test/util.test.js passes; the full unit run has the same pre-existing failures with and without this change in my environment (thenable args, exports chalk level, log/fetch tests)
• Docs: no docs change needed
• Sign
• CoC
• Review: I reviewed the change and tested it myself, it is not solely generated by AI tools

[gemini-code-assist]

Code Review

This pull request updates PowerShell argument quoting in build/util.cjs and src/util.ts to handle special single quote characters (U+2018, U+2019, U+201A, and U+201B) by doubling them, and adds corresponding unit tests. The review feedback suggests optimizing the replacement logic in src/util.ts by using a regex capture group and a replacement string instead of a callback function to improve performance.

[gargarnav]

Addressed the review feedback and re-signed the commit. Could a maintainer approve the pending workflows when you get a chance? Thanks!