Agent 0.44 Runs Quoted Windows Commands as Written
October 22, 2026 · InfraScout Team
Agent 0.44.1 is rolling out. It fixes how Windows shell commands handle double quotes, makes time windows work on JSON-formatted log files, and makes the log explain why performance counters or tracing are unavailable on a host. None of it needs action from you: agents pick it up through your update policies as usual.
Quoted Commands on Windows
When the AI runs a shell command on a Windows host, the agent hands it to cmd.exe. Until now, every double quote in that command arrived at cmd.exe with a backslash in front of it, which cmd.exe does not understand. A quoted program path with spaces, such as "C:\Program Files\…\tool.exe" --flag, failed with is not recognized, and quoted arguments like findstr "error" or sc query "Service Name" searched for the wrong text or failed outright.
From agent 0.44.1, cmd.exe receives the command line exactly as written, so these commands behave the way they do at a command prompt. If you noticed the AI falling back to PowerShell for commands that should have been one-liners, this is why, and it no longer needs to. Expect some output to change, too: a findstr that used to match nothing because of the stray backslashes now returns real matches. See agent_exec_shell.
Time Windows on JSON-Line Logs
The log-reading tool can narrow a read to a time window, matched against the timestamp at the start of each line. A JSON-line log, where every line is a JSON object, has no timestamp there, so a time window used to drop every line. That includes the InfraScout agent's own log.
From agent 0.44.1, the tool reads the line's time, ts or timestamp field instead, when it holds a standard timestamp. Asking the AI what the agent logged around a failed update now returns those lines instead of nothing. See Timestamp Handling.
Clearer Reasons for Missing Counters and Tracing
A Windows agent running as a constrained account, such as a gMSA, may not be allowed to read performance counters or start a trace session, so it does not offer those capabilities. The agent's log records why. From agent 0.44.1, that line names what to change: a refused trace session points at Administrators or Performance Log Users, and counters whose names the account cannot read point at Performance Monitor Users or Performance Log Users. Capabilities explains which group grants what, and why Performance Log Users is worth granting only where you need it.