statamic new <site> incorrectly saves the superuser password on Windows

[AtmoFX]

Bug description

The statamic new <site name> command may not save the superuser password correctly, resulting in the impossibility to connect with the password typed during the process, which makes it confusing.

How to reproduce

1. Run statamic new <site name> with a site name of your choosing. Make it so a superuser will be created in the process.
2. When asked for the super user password, type anything that contains a $, for instance 123$456789.
3. Open the site and try to connect to the control panel. Using 123$456789 is not the correct password but 123 is.
   Apparently, $ and everything to its right is ignored.

Logs

No response

Environment

Environment
Application Name: Statamic
Laravel Version: 11.26.0
PHP Version: 8.3.12
Composer Version: 2.7.7
Environment: local
Debug Mode: ENABLED
URL: Test.test
Maintenance Mode: OFF
Timezone: UTC
Locale: en

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: file
Database: sqlite
Logs: stack / single
Mail: log
Queue: sync
Session: file

Statamic
Addons: 0
Sites: 1
Stache Watcher: Enabled (auto)
Static Caching: Disabled
Version: 5.29.0 Solo

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

[duncanmcclean]

Which operating system are you using?

[AtmoFX]

I am on Windows 11.

[jasonvarga]

Works fine on Mac, at least.

[duncanmcclean]

It probably has something to do with the CLI's "make user" code.

Since Windows doesn't have TTY (which means we can't defer to Core's make:user command), the user gets created manually.

cli/src/NewCommand.php

Lines 669 to 702 in 304a0b2

	protected function makeSuperUserInWindows()
	{
	$please = (new Please($this->output))->cwd($this->absolutePath);
	// Ask for email
	while (! isset($email) || ! $this->validateEmail($email)) {
	$email = $this->askForBasicInput('Email');
	}
	// Ask for name
	$name = $this->askForBasicInput('Name');
	// Ask for password
	while (! isset($password) || ! $this->validatePassword($password)) {
	$password = $this->askForBasicInput('Password (Your input will be hidden)', true);
	}
	// Create super user and update with captured input.
	$please->run('make:user', '--super', $email);
	$updateUser = '\Statamic\Facades\User::findByEmail('.escapeshellarg($email).')'
	.'->password('.escapeshellarg($password).')'
	.'->makeSuper()';
	if ($name) {
	$updateUser .= '->set("name", '.escapeshellarg($name).')';
	}
	$updateUser .= '->save();';
	$please->run('tinker', '--execute', $updateUser);
	return $this;
	}

escapeshellarg($password) might be causing it.