fix bug

Author: h3xxit

plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py

@@ -380,8 +380,12 @@ def _substitute_utcp_args(
                                                    as a single token)
 
           powershell (Windows):
-            - bare:                ``$env:VAR``
-            - inside double quotes: ``$env:VAR``   (PS expands inside dq)
+            - bare:                ``${env:VAR}``
+            - inside double quotes: ``${env:VAR}``  (PS expands inside dq;
+                                                     braced form prevents
+                                                     suffix characters
+                                                     from being consumed
+                                                     into the var name)
             - inside single quotes: ValueError -- PS does not expand inside
                                                   single-quoted strings, so
                                                   we cannot safely
@@ -524,9 +528,17 @@ def collect(name: str) -> str:
                         f"instead."
                     )
                 v = collect(m.group(1))
-                # Both bare and dq accept `$env:VAR` -- PowerShell expands
-                # it inside double-quoted strings.
-                out.append(f"$env:{v}")
+                # Use the braced form `${env:VAR}` rather than `$env:VAR`
+                # so the variable name is explicitly delimited. The bare
+                # form lets PowerShell's lexer keep consuming
+                # alphanumerics + `_` until it hits a non-identifier
+                # char, which would silently swallow any suffix text in
+                # the template (e.g. template
+                # ``"URL=UTCP_ARG_id_UTCP_END123"`` would be substituted
+                # as ``"URL=$env:__UTCP_ARG_<nonce>_id123"`` and resolve
+                # an env var that does not exist). Braces close that
+                # boundary cleanly.
+                out.append("${env:" + v + "}")
                 i = m.end()
                 continue
 

plugins/communication_protocols/cli/tests/test_cli_security.py

@@ -82,21 +82,39 @@ def test_bash_escaped_dq_does_not_flip_state(self, transport):
         assert cmd == f'echo "esc\\" ${{{_v("a")}}}"'
 
     @pytest.mark.skipif(os.name != "nt", reason="PowerShell semantics")
-    def test_ps_bare_emits_env_var(self, transport):
+    def test_ps_bare_emits_braced_env_var(self, transport):
         cmd, env = transport._substitute_utcp_args(
             "mytool UTCP_ARG_x_UTCP_END", {"x": "a b"}, NONCE
         )
-        assert cmd == f"mytool $env:{_v('x')}"
+        # Braced form so suffix chars cannot be consumed into the var
+        # name boundary.
+        assert cmd == "mytool ${env:" + _v("x") + "}"
         assert env[_v("x")] == "a b"
 
     @pytest.mark.skipif(os.name != "nt", reason="PowerShell semantics")
-    def test_ps_dq_emits_env_var(self, transport):
+    def test_ps_dq_emits_braced_env_var(self, transport):
         cmd, env = transport._substitute_utcp_args(
             'Write-Output "Hi UTCP_ARG_x_UTCP_END!"', {"x": "a; rm /"}, NONCE
         )
-        assert cmd == f'Write-Output "Hi $env:{_v("x")}!"'
+        assert cmd == 'Write-Output "Hi ${env:' + _v("x") + '}!"'
         assert env[_v("x")] == "a; rm /"
 
+    @pytest.mark.skipif(os.name != "nt", reason="PowerShell semantics")
+    def test_ps_alphanumeric_suffix_does_not_extend_var_name(self, transport):
+        # Regression: with the bare `$env:VAR` form, an alphanumeric or
+        # underscore suffix in the template would be parsed as part of
+        # the env var name. The braced form `${env:VAR}` closes the
+        # boundary cleanly so the template suffix stays literal.
+        cmd, env = transport._substitute_utcp_args(
+            'Write-Output "URL=UTCP_ARG_id_UTCP_END123suffix"',
+            {"id": "abc"},
+            NONCE,
+        )
+        assert cmd == (
+            'Write-Output "URL=${env:' + _v("id") + '}123suffix"'
+        )
+        assert env[_v("id")] == "abc"
+
     @pytest.mark.skipif(os.name != "nt", reason="PowerShell semantics")
     def test_ps_sq_raises_with_clear_message(self, transport):
         with pytest.raises(ValueError, match="single-quoted"):
@@ -110,7 +128,7 @@ def test_ps_backtick_in_dq_preserved(self, transport):
             'Write-Output "pre `"x`" UTCP_ARG_a_UTCP_END"', {"a": "v"}, NONCE
         )
         # dq state must still be active when placeholder is hit.
-        assert cmd == f'Write-Output "pre `"x`" $env:{_v("a")}"'
+        assert cmd == 'Write-Output "pre `"x`" ${env:' + _v("a") + '}"'
 
     def test_multiple_placeholders_share_namespace(self, transport):
         cmd, env = transport._substitute_utcp_args(
@@ -132,7 +150,10 @@ def test_multiple_placeholders_in_same_dq_compose(self, transport):
             NONCE,
         )
         if os.name == "nt":
-            assert cmd == f'curl "https://api/$env:{_v("id")}/$env:{_v("action")}"'
+            assert cmd == (
+                'curl "https://api/${env:' + _v("id")
+                + '}/${env:' + _v("action") + '}"'
+            )
         else:
             assert (
                 cmd