Quote activation exports and paths for space-containing roots

[robmaceachern]

Note

Disclaimer: I'm not a go dev but hit this bug today and figured I'd throw up a PR with the assistance of AI. Feel free to mock and/or shame me 😂

Summary

• quote all path-derived values emitted by Hermit activation scripts so eval is safe when environment roots contain spaces
• quote command substitutions and path arguments used during activate/deactivate/update flows in POSIX and fish templates
• add regression unit tests for generated activation scripts with space-containing roots
• add an integration test that activates an environment located in a directory with spaces

How This Was Discovered

This surfaced while running Hermit from a CodexMonitor-managed git worktree. CodexMonitor stores worktrees under:

~/Library/Application Support/com.dimillian.codexmonitor/worktrees/...

Because Application Support contains a space, source bin/activate-hermit failed when hermit activate emitted unquoted export values. Shell eval split those values, causing activation errors in zsh/bash.

Testing

• go test ./...
• go test -tags=integration ./integration -run 'TestIntegration/ActivationWorksWhenPathContainsSpaces' -count=1

---

This response was drafted with AI assistance.

[wsutina]

I found that this example passes before the fix. Can we use a more complex path like your unit test "/tmp/Application Support/hermit env"?

[robmaceachern]

Good catch! Updated in 023c4ee and codex's explanation on why the original test shape didn't actually reveal the issue.

Details

export accepts both of these argument forms:

1. NAME=value (assign + export)
2. NAME (export an existing variable, or create empty one)

So when unquoted output is:

export HERMIT_ENV=/tmp/env with spaces

the shell parses it as 3 arguments:

1. HERMIT_ENV=/tmp/env
2. with
3. spaces

with and spaces match valid shell variable-name syntax ([A-Za-z_][A-Za-z0-9_]*), so export accepts them. No syntax error.

That means:

• HERMIT_ENV gets the wrong truncated value (/tmp/env)
• with and spaces are just exported as variables
• command still exits successfully

But with:

export HERMIT_ENV=/tmp/Application Support/hermit env

one token becomes Support/hermit, which is not a valid variable name (contains /), so export errors. That’s why the Application Support/hermit env shape reliably exposes the bug.

[wsutina]

Thank you so much for the fix! I got a few minor comments. Once that's addressed, I will merge and release the PRs :)

[wsutina]

For consistency can we add "" to:

Suggested change

	set -gx HERMIT_BIN_CHANGE $(date -r "$HERMIT_ENV/bin" +"%s")
	set -gx HERMIT_BIN_CHANGE "$(date -r "$HERMIT_ENV/bin" +"%s")"

and

set CURRENT "$(date -r "$HERMIT_ENV/bin" +"%s")"

too?

[robmaceachern]

Updated in 023c4ee!