Agent writes invalid PowerShell on Windows (recurring patterns) #5302

Describe the bug

When running on Windows, the Copilot CLI agent often writes PowerShell commands that fail to parse or run, so it has to retry. Each retry is an extra tool call plus a model turn. From 3 weeks of my session logs (2,164 unique shell calls), these patterns recur:

• Substring with IndexOf = -1, no bounds check (7 calls / 4 sessions)
• "$var: text" in a double-quoted string → ParserError; needs "${var}: text" (4/3)
• multi-line if/else joined into "}; elseif" → 'elseif' is not recognized (2/2)
• ConvertFrom-Json on package-lock.json without -AsHashtable, which fails on the empty "" key (2/2)
• bash-style " escaping inside a single-quoted jq filter → jq parse error (1/1)

Expected: the agent writes valid PowerShell 7 for the powershell tool: no bash-isms, braces around a variable before ":", if/elseif blocks on separate lines, IndexOf results checked before Substring, and -AsHashtable for package-lock.json.

Affected version

GitHub Copilot CLI 1.0.105. Windows 11, PowerShell 7.6.9, model claude-opus-5.5.

Steps to reproduce the behavior

Each line below is a command of the kind the agent generated. Run each one in pwsh -NoProfile:

1. $s="x"; "$s: y" → ParserError: Variable reference is not valid
2. if ($false) { 1 }; elseif ($true) { 2 } → 'elseif' is not recognized
3. '{"":1}' | ConvertFrom-Json → "property whose name is an empty string … only supported using the -AsHashTable switch"
4. "abc".Substring(0, [Math]::Min("abc".IndexOf("z"), 10)) → ArgumentOutOfRangeException (length -1)

Expected behavior

On Windows, the agent writes valid PowerShell 7 for the powershell tool: no bash-style escaping ("), braces around a variable before a colon ("${var}:"), if/elseif/else kept on one block instead of joined with ";", IndexOf results checked before Substring, and ConvertFrom-Json -AsHashtable for files such as package-lock.json. The command should work on the first try, without a retry turn.

Additional context

• Counts come from my local session logs (~/.copilot/session-state/*/events.jsonl), 2026-10-09 to 2026-10-30. Calls were deduplicated by tool-call ID, because resumed sessions copy their history.
• 11% of shell calls were flagged with a shell_error_category, but most of those were environment issues or real build failures. The patterns above are the ones caused by the generated command itself.
• I searched the github/copilot-cli issues and found no existing report for these patterns.
• Workaround: I added PowerShell rules to ~/.copilot/copilot-instructions.md. That shouldn't be needed for every Windows user.