vm-repair: do not quote the az token when invoking nested commands on…

[Edwin Bernal Microsoft (EdwinBernal1)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

… Windows

Quoting the program name made cmd.exe skip the PATH search, so %~dp0 inside az.cmd no longer resolved to the launcher directory and every nested az call failed with 'Failed to load python executable.' on stdout and an empty stderr. Arguments remain individually quoted, preserving the MSRC 115198 hardening. A failed az call now falls back to stdout, reports the exit code when there is no output, and masks secure parameters instead of raising an empty AzCommandError.

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az vm repair create / az vm repair run / az vm repair restore / az vm repair reset-nic /
az vm repair repair-and-restore / az vm repair repair-button

All of them shell out to a nested az call through _call_az_command, so all were affected on
Windows where az resolves to the az.cmd launcher.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? — azdev style vm-repair: PASSED (pylint + flake8)
• Have you run python scripts/ci/test_index.py -q locally? — OK (9 tests, 2 skipped)
• My extension version conforms to the Extension version schema — 2.2.4 -> 2.2.5, patch bump for a
  bug fix with no command, parameter, or default changes

Additional validation:

• azdev linter vm-repair: PASSED, no violations
• azdev test vm-repair: 94 passed, 35 skipped (skipped = LiveScenarioTest, not run to avoid
  creating Azure resources)
• New regression tests fail on the unpatched code (7 failures, including the exact production
  signature AzCommandError('')) and pass with the fix

For new extensions:

• N/A - not a new extension

About Extension Publish

src/index.json was not modified. Only setup.py (VERSION) and HISTORY.rst were updated, as
required.

[azure-client-tools-bot-prd]

Hi Edwin Bernal Microsoft (@EdwinBernal1),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR fixes a Windows-specific regression in the vm-repair extension where nested az invocations failed when az resolves to az.cmd (common on MSI installs), and improves error reporting for failed nested az calls when stderr is empty.

Changes:

• Adjust Windows command construction to avoid quoting the az executable token while keeping per-argument quoting for command-injection hardening.
• Improve AzCommandError messages by falling back to stdout, reporting exit codes when there’s no output, and masking secure parameters.
• Add regression tests covering Windows quoting behavior and improved error surfacing; bump version and update history.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/vm-repair/azext_vm_repair/repair_utils.py	Fixes Windows nested az command-line construction and improves error message surfacing/masking.
src/vm-repair/azext_vm_repair/tests/latest/test_nested_az_invocation.py	Adds regression tests for Windows nested invocation behavior and error-message handling.
src/vm-repair/setup.py	Bumps extension version to 2.2.5.
src/vm-repair/HISTORY.rst	Documents the 2.2.5 regression fix and error-reporting improvements.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[azure-client-tools-agent]

Automated sensitive-information remediation ran on this pull request.

• Detected categories: credential
• Replaced with typed [REDACTED:category] placeholders in: no PR metadata fields
• Comment/review owners notified because Agent Assist cannot edit another user's text: none

Agent Assist does not modify source files. The PR creator must remove or replace each suspected value at the linked line:

• src/vm-repair/azext_vm_repair/tests/latest/test_nested_az_invocation.py:160 — possible credential

If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).