more fixes

Author: gcurtis

internal/devbox/devbox.go

@@ -270,15 +270,25 @@ func (d *Devbox) RunScript(ctx context.Context, envOpts devopt.EnvOptions, cmdNa
 	// better alternative since devbox run and devbox shell are not the same.
 	env["DEVBOX_SHELL_ENABLED"] = "1"
 
-	// wrap the arg in double-quotes, and escape any double-quotes inside it
+	// wrap the arg in double-quotes, and escape any double-quotes inside it.
+	//
+	// TODO(gcurtis): this breaks quote-removal in parameter expansion,
+	// command substitution, and arithmetic expansion:
+	//
+	//	$ unset x
+	//	$ echo ${x:-"my file"}
+	//	my file
+	//	$ devbox run -- echo '${x:-"my file"}'
+	//	"my file"
 	for idx, arg := range cmdArgs {
 		cmdArgs[idx] = strconv.Quote(arg)
 	}
 
 	var cmdWithArgs []string
 	if _, ok := d.cfg.Scripts()[cmdName]; ok {
 		// it's a script, so replace the command with the script file's path.
-		cmdWithArgs = append([]string{shellgen.ScriptPath(d.ProjectDir(), cmdName)}, cmdArgs...)
+		script := shellgen.ScriptPath(d.ProjectDir(), cmdName)
+		cmdWithArgs = append([]string{strconv.Quote(script)}, cmdArgs...)
 	} else {
 		// Arbitrary commands should also run the hooks, so we write them to a file as well. However, if the
 		// command args include env variable evaluations, then they'll be evaluated _before_ the hooks run,
@@ -293,7 +303,8 @@ func (d *Devbox) RunScript(ctx context.Context, envOpts devopt.EnvOptions, cmdNa
 		if err != nil {
 			return err
 		}
-		cmdWithArgs = []string{shellgen.ScriptPath(d.ProjectDir(), arbitraryCmdFilename)}
+		script := shellgen.ScriptPath(d.ProjectDir(), arbitraryCmdFilename)
+		cmdWithArgs = []string{strconv.Quote(script)}
 		env["DEVBOX_RUN_CMD"] = strings.Join(append([]string{cmdName}, cmdArgs...), " ")
 	}
 

internal/devbox/shellrc_fish.tmpl

@@ -59,7 +59,7 @@ set workingDir (pwd)
 cd "{{ .ProjectDir }}" || exit
 
 # Source the hooks file, which contains the project's init hooks and plugin hooks.
-source {{ .HooksFilePath }}
+source "{{ .HooksFilePath }}"
 
 cd "$workingDir" || exit
 

internal/shellgen/tmpl/script-wrapper.tmpl

@@ -1,5 +1,5 @@
-{{/* 
-    This wraps user scripts in devbox.json. The idea is to only run the init 
+{{/*
+    This wraps user scripts in devbox.json. The idea is to only run the init
     hooks once, even if the init hook calls devbox run again. This will also
     protect against using devbox service in the init hook.
 
@@ -8,7 +8,7 @@
 */ -}}
 
 if [ -z "${{ .SkipInitHookHash }}" ]; then
-    . {{ .InitHookPath }}
+    . "{{ .InitHookPath }}"
 fi
 
 {{ .Body }}

testscripts/basic/path_whitespace.test.txt

@@ -0,0 +1,23 @@
+# Test that Devbox handles whitespace in project paths.
+
+mkdir 'my project'
+cd 'my project'
+
+exec devbox run -- hello
+stdout 'Hello, world!'
+
+exec devbox run -- touch 'file1 with spaces'
+exists 'file1 with spaces'
+
+exec devbox run test
+exists 'file2 with spaces'
+
+-- my project/devbox.json --
+{
+  "packages": ["hello@latest"],
+  "shell": {
+    "scripts": {
+      "test": "touch 'file2 with spaces'"
+    }
+  }
+}