shell-quote is full of bugs -_-

seriously, how did this happen?? this is the one kind of library you'd
assume couldn't possibly have bugs, because it's so obviously critical
for the thing to be thoroughly tested. and it's not even complicated
functionality to implement...

backend/lsp-repl.js

@@ -2,10 +2,10 @@ import child_process from "child_process";
 import process from "process";
 
 import readline from "historic-readline";
-import { quote } from "shell-quote";
 import rpc from "vscode-jsonrpc";
 
 import { langsPromise } from "./langs.js";
+import { quote } from "./util.js";
 
 const args = process.argv.slice(2);
 
@@ -32,7 +32,7 @@ if (args.length === 1 && langs[args[0]] && langs[args[0]].lsp) {
   cmdline = args;
 }
 
-console.error(quote(cmdline));
+console.error(cmdline.map(quote).join(" "));
 const proc = child_process.spawn(cmdline[0], cmdline.slice(1));
 
 proc.stderr.on("data", (data) => process.stderr.write(data));

backend/sandbox.js

@@ -3,7 +3,6 @@ import { promises as fs } from "fs";
 import process from "process";
 
 import pty from "node-pty";
-import { quote } from "shell-quote";
 
 import { readLangConfig } from "../lib/yaml.js";
 import {
@@ -13,6 +12,7 @@ import {
   privilegedPty,
   privilegedSession,
   privilegedWait,
+  quote,
   run,
 } from "./util.js";
 
@@ -39,19 +39,12 @@ async function main() {
     name: "xterm-color",
   });
   await run(privilegedWait({ uuid }), log);
-  console.log(
-    bash(
-      `env L='${lang}' LANG_CONFIG=${quote([
-        JSON.stringify(langConfig),
-      ])} bash --rcfile <(cat <<< ${quote([sandboxScript])})`
-    )[2]
-  );
   const args = privilegedPty(
     { uuid },
     bash(
-      `env L='${lang}' LANG_CONFIG=${quote([
+      `env L='${lang}' LANG_CONFIG=${quote(
         JSON.stringify(langConfig),
-      ])} bash --rcfile <(cat <<< ${quote([sandboxScript])})`
+      )} bash --rcfile <(cat <<< ${quote(sandboxScript)})`
     )
   );
   const proc = spawn(args[0], args.slice(1), {

backend/util.js

@@ -2,9 +2,12 @@ import { spawn, spawnSync } from "child_process";
 import os from "os";
 import process from "process";
 
-import { quote } from "shell-quote";
 import { v4 as getUUIDOrig } from "uuid";
 
+export function quote(str) {
+  return "'" + str.replace(/'/g, `'"'"'`) + "'";
+}
+
 export const rijuSystemPrivileged = "system/out/riju-system-privileged";
 
 export function getUUID() {

package.json

@@ -32,7 +32,6 @@
     "parse-passwd": "^1.0.0",
     "prettier": "^2.3.1",
     "regenerator-runtime": "^0.13.7",
-    "shell-quote": "^1.7.2",
     "strip-ansi": "^6.0.0",
     "style-loader": "^2.0.0",
     "uuid": "^8.3.2",

yarn.lock

@@ -3939,11 +3939,6 @@ shebang-regex@^3.0.0:
   resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172"
   integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
 
-shell-quote@^1.7.2:
-  version "1.7.2"
-  resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.7.2.tgz#67a7d02c76c9da24f99d20808fcaded0e0e04be2"
-  integrity sha512-mRz/m/JVscCrkMyPqHc/bczi3OQHkLTqXHEFu0zDhK/qfv3UcOA4SVmRCLmos4bhjr9ekVQubj/R7waKapmiQg==
-
 signal-exit@^3.0.3:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/signal-exit/-/signal-exit-3.0.3.tgz#a1410c2edd8f077b08b4e253c8eacfcaf057461c"