[mehdikarimi55]

Fixes #5360

Problem

tests/test_workflow_step_submission.py::test_fetch_keeps_malicious_text_in_one_argument_even_if_validation_is_bypassed fails 4 times (one per parametrized suffix) when the spec-kit checkout lives under a path containing whitespace — e.g. ~/Downloads/GitHub Contribution/spec-kit:

E   step_submission_verifier.Blocked: cannot download https://...: [Errno 2] No such file or directory: 'curl'

Root cause

The fixture writes its fake curl with a #!{sys.executable} shebang. On macOS the XNU kernel splits the shebang line on whitespace, so an interpreter path like /Users/me/Downloads/GitHub Contribution/spec-kit/.venv/bin/python is parsed as interpreter /Users/me/Downloads/GitHub with argument Contribution/.... execve fails with ENOENT and the test reports "No such file or directory: 'curl'". GitHub CI never sees this (runner paths have no spaces), but desktop checkouts with a space in the path hit it deterministically.

Fix

Route the fake curl through #!/bin/sh with a shlex.quoted interpreter — the same established pattern as _ensure_test_python_on_path() in tests/extensions/test_extension_agent_context.py and make_python3_path_shim() in tests/parity_helpers.py. With -c, sys.argv[1:] is exactly the argument list curl was invoked with, so the test's assertions (len(args) == 14, args[-1] == url) are unchanged.

Test-only change; no product code touched.

Evidence

Reproduction of the kernel behavior outside the suite:

mkdir -p "/tmp/space test"
ln -s "$(command -v python3)" "/tmp/space test/python"
printf '#!/tmp/space test/python\nprint(1)\n' > /tmp/script
chmod +x /tmp/script
/tmp/script   # macOS: OSError: [Errno 2] No such file or directory

And in the suite, in the affected environment (macOS 15 arm64, checkout under a path with a space):

.venv/bin/python -m pytest tests/test_workflow_step_submission.py -q
# before: 4 failed   after: 271 passed

AI disclosure

Agent-authored commit and PR — OpenCode running GLM 5.3 Flash (Z.ai), agent mode under human supervision by @mehdikarimi55. The agent performed reproduction, root-cause analysis, the code change, and test execution; changes were reviewed by the account owner before submission.

[Copilot]

🟢 Approval recommended

No active review issues are reported, and the fixture change preserves the existing security assertions while addressing interpreter paths containing whitespace.

No open issues 🎉

What changed in this PR

This test-only PR hardens the workflow-step submission verifier’s fake curl fixture so it works when sys.executable is located under a path containing whitespace, particularly on macOS.

Changes:

• Replaces the whitespace-sensitive Python shebang with a /bin/sh wrapper.
• Uses shlex.quote to safely invoke Python while preserving the original curl argument list.
• Retains the existing malicious-input and injection-prevention assertions.

File	Description
tests/​test_workflow_step_submission.py	Updates the fake curl fixture to safely invoke Python from interpreter paths containing whitespace.

_{Review effort: Lite (auto)}

[Copilot]

🟡 Changes recommended

The regression test does not reliably verify the reported shebang fix because it uses an ambient interpreter path without whitespace, allowing the old behavior to pass on CI.

1 open issue

• Test shebang quoting with an interpreter path containing spaces · New

_{Review effort: Lite (auto)}

[mnriem]

Please address Copilot feedback

[Copilot]

🟢 Approval recommended

No active review issues are reported, and the fixture change addresses interpreter paths containing whitespace while preserving argument-integrity coverage.

No open issues 🎉

1 resolved since last review

• Test shebang quoting with an interpreter path containing spaces

_{Review effort: Lite (auto)}