01 · Before and afterThe pattern
// before: word-splits on spaces, glob-expands, runs whatever the string becomes
const script = `chmod +x ${file} && ${file}`;
// after: quote each value as one shell word; expand ~ yourself before quoting
const q = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
const path = file.startsWith('~/') ? `"$HOME"/${q(file.slice(2))}` : q(file);
const script = `chmod +x ${path} && ${path}`;02 · Run it on your appThe check
If a user's path contains a space, does every shell command your app generates still work?
If the honest answer is no or not sure, this is worth a look before it reaches production.