From 02c638d754fcd7260881a4fd18ebb8ac7df81087 Mon Sep 17 00:00:00 2001
From: Arnav Garg <gargarnav2007@gmail.com>
Date: Fri, 16 Oct 2026 05:11:27 +0530
Subject: [PATCH] fix(util): escape Unicode single quotes in quotePowerShell

PowerShell treats U+2018, U+2019, U+201A and U+201B as single-quote
characters, so a value containing one of them ended the quoted string
early and the rest of the value was parsed as PowerShell code. Double
all of them, as is done for the ASCII apostrophe, and add tests.
---
 build/util.cjs    | 2 +-
 src/util.ts       | 3 ++-
 test/util.test.js | 3 +++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/build/util.cjs b/build/util.cjs
index 1df79370d1..f3797f0467 100644
--- a/build/util.cjs
+++ b/build/util.cjs
@@ -69,7 +69,7 @@ function quote(arg) {
 function quotePowerShell(arg) {
   if (arg === "") return `''`;
   if (/^[\w/.\-@:=,+%]+$/.test(arg)) return arg;
-  return `'` + arg.replace(/'/g, "''") + `'`;
+  return `'` + arg.replace(/(['\u2018\u2019\u201A\u201B])/g, '$1$1') + `'`;
 }
 function parseDuration(d) {
   if (typeof d === "number") {
diff --git a/src/util.ts b/src/util.ts
index 1a272905ba..cb6288f5f9 100644
--- a/src/util.ts
+++ b/src/util.ts
@@ -95,7 +95,8 @@ export function quotePowerShell(arg: string): string {
   if (arg === '') return `''`
   if (/^[\w/.\-@:=,+%]+$/.test(arg)) return arg
 
-  return `'` + arg.replace(/'/g, "''") + `'`
+  // PowerShell treats U+2018, U+2019, U+201A and U+201B as single quotes too.
+  return `'` + arg.replace(/(['\u2018\u2019\u201A\u201B])/g, '$1$1') + `'`
 }
 
 export type Duration =
diff --git a/test/util.test.js b/test/util.test.js
index fba510fcab..2befa564c7 100644
--- a/test/util.test.js
+++ b/test/util.test.js
@@ -81,6 +81,9 @@ describe('util', () => {
     assert.equal(quotePowerShell('string'), 'string')
     assert.equal(quotePowerShell(`'`), `''''`)
     assert.equal(quotePowerShell(''), `''`)
+    for (const q of ['\u2018', '\u2019', '\u201A', '\u201B']) {
+      assert.equal(quotePowerShell(`x${q}y`), `'x${q}${q}y'`)
+    }
 
     const allowed =
       'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_/.-+@:=,%'